Executing action of a disabled Button

I have a commandButton with a specific action which is disabled. The button is rendered with a disabled attribute and gets a bit different onclick script.

Problem is, when the user removes the disabled and onclick attributes, with for example Firebug, it is possible to click the button. And JSF does not prevent the action from being executed.

I expected that the execution is prevented also on server-side.