There is currently this comment in the LiskDAO class:
// TODO: There is currently no protection on 'r' queries against writing.
If this is still the case, this seems worthwhile fixing. If I understand correctly, there is currently nothing preventing writes on database connections established with establishConnection('r').