User created a Custom Body Field which has type of Document.
Then disabled the field via Workflow or Script but it is still possible to edit and upload a document.
Solution
The reason why this is still possible is that NetSuite Standard custom buttons applied outside the field keep their main functionality.In this case, these are the fields Plus and New Window icons. These fields cannot be disabled by any Script or Workflow.
The same rule applies for fields of Date type. Even after disabling using the Calendar button parent, the field keeps its functionality.