When a Slave is read-only, it is not 100% shielded from the world.
According to MySQL Documentation on
This variable is off by default. When it is enabled, the server permits no updates except from users that have the SUPER privilege or (on a slave server) from updates performed by slave threads. In replication setups, it can be useful to enable read_only on slave servers to ensure that slaves accept updates only from the master server and not from clients.
Thus, anyone with SUPER privilege can read and write at will to such a Slave...
Make sure all non-privileged users do not have the SUPER Privilege.
If you want to revoke all SUPER privileges in one shot, please run this on Master and Slave:
UPDATE mysql.user SET super_priv='N' WHERE user<>'root';
With reference to the Slave, this will reserve SUPER privilege to just
root and prevent non-privileged from doing writes they would otherwise be restricted from.