An administrator adds a sensitive field to a page layout and marks it read-only there. Why is this insufficient as the only security control?

1. A field label determines all security behavior
2. A page layout always changes the database column into immutable storage
3. Page layout behavior does not replace field-level security across all access paths
4. A read-only layout automatically removes every API permission