JMX operations on broker bypass authorization plugin

When securing the broker using authentication and authorization, any JMX operations on the broker completely bypass the authorization plugin.
So anyone can modify the broker bypassing security checks
Also, because of this its not possible to define a read only user for the web console.