If any user has "Viewer" role alone, He/She can't create Disk Snapshot, BQ Job or other "create" permission which are included in "Viewer" role.

I don't see any security issue but this can be a question to Google - "Why these write/create permissions are added into Viewer role"