I agree with you, I imagine your parent's reply was could have been sarcastic that got lost in text.

It's really an authorisation issue as to who/what can update which parts of a model - generally this is handled in the controller.