If a user shares their project with a non-subscriber, that non-subscriber also gets admin rights. See this email:
Re: Fwd: Bcloud projects question From: Nelson Gonçalves <email@example.com> To: "Dr. Sybren A. Stüvel" <firstname.lastname@example.org> Date: Yesterday 22:18 Hi again, The project is this one: https://cloud.blender.org/p/p-574635c7c379cf17984532f6/ Pedro Araujo (pholdrep) is not an active/pay subscriber, he has a free account, created to store blender settings. I'm sharing my project with him and he was able to upload files to this project. All the best, nelson
We might want to at least prevent people from uploading new stuff to a project when they're not subscribers. However, such a change may have quite an impact on the permission system.
Also see T49561