On a metadata external-or-resource-image, set a restriction

<restrict-to>
<right read-write-direction="write" id="Thumbnail_Vertical_Rights"/>
</restrict-to>

Then go to back-office with a user that does not have the rights. Click on the cross to remove the picture, the button is enabled, it should be disabled.
The user can add a picture.

But then if the user save the content, nothing is removed.