essentially, but, ANY domain controller can make changes to Active Directory by default(may be able to limit this), it is not like NT where there were clearly defined roles for domain controllers, where backups were just that, backups, and all changes needed to happen on the primary. Therefore, if you have a global catalog on each domain controller(and I believe the global catalog MUST be on a domain controller), it is NOT read only.

The catalog may be read only, but since the dc can modify it .....

I was just trying to say that you wont have two servers of which only one of them can modify the catalog.

EDIT:::
I understood you to say that you wanted one of them to be read only.