Why user with ONLY READ permission can remove tags added by another user?
User with ONLY READ permission can remove tags added by another user which has all granted permissions. He shouldn't be able to do it. Why is that so?
This is an implementation choice: we chose to make tags unrestricted which means that users just need Read permission to be able to add or delete tags and tags don't have an author.
This behaviour cannot be changed by XML configuration. It would require some coding / template overriding to make the delete icon (cross) displayed only if the current user has at least Write permission.