I'm actually confused by this actually.  Are you asserting that read-only is enough for DBAdmin on the gallery?  If so, that's not true - we do read/write on there to assign users to the admin role or to force ownership changes for packages if the current owner's account is dead and we need to move the package to a new owner.