Hi Jamie,
If that is the security concern then there is nothing to worry about. The fact that you are able to start the import job does not mean anything actually gets imported. The job will still check if the users that started the job actually has the permissions to Import at all, let alone it checks whether the user has the permissions to create new objects. Since this does not appear to be the case you should be ok.
On a side note, if these are only 'read' users, why don't you setup a 'read only' Navigation bar with only some shortcuts to useful job filters?
Regards Gerben