I thought they could be, but as I'm not putting my money where my mouth was (so to speak) setting the read-only attribute doesn't actually seem to do anything.
I'd rather not use Disabled since I want the checked check boxes to be submitted with the rest of the form, I just don't want the client to be able to change them under certain circumstances.