The wallet where you execute the command should have the "disable_private_keys" argument set to "true" when it's created.
In the GUI, the check box with the same name "Disabled Private Keys" should be ticked.
In Descriptor wallets, it's not possible to import plain address descriptors to a non-watching-only wallet so this wouldn't have happened.
Yes, I explicitly created a legacy wallet for the purposes of testing some Python core that uses the RPC, so that I don't have to spin up a bunch of altcoin nodes as well (except for maybe DOGE, which has seemingly removed any way of selecting wallet files via createwallet and -rpcwallet).