Read-Only permission is able to create new list item using the list forms shared with them

johnjohn-Peter  This is how Microsoft have designed the new SharePoint Forms - it allow users without any permissions (even without read) to submit items to the list - but they can't see any items.

So, you can have a list where a user has no permissions whatsoever, and the first time they use the SharePoint Form (via the link you provided) it automatically adds two roles to the user on the list - Limited Access and Submit Files. This allows the user to add items to the list but that's it.

One caveat - initially the user wouldn't have any permissions to the list - so they get access denied when they try to navigate directly to the list. But after they submit an item via the Form and are granted Limited Access on the list and are now able to navigate to the list - they just don't see any items. And if they try to export to Excel it won't show any records - even the ones they submitted.

So, this is by design - but yes, something that many users across businesses don't realise when they are creating these new Microsoft List or SharePoint Forms.

If you don't want ANYONE to be able to submit items to your list, then you shouldn't be using SharePoint Forms.