When Case stage field is not editable, manual stage change should not be allowed

A big security hole in using cases to display the status of a record is that the stage can be manually changed even when the stage field is Read Only.  I intentionally set a status field to Read Only so that a process manages the status changes, but if I use it to display stage flow visually, I can still click on the case display to change the status, which is undesirable.