I have discovered a difference between the Windows Client and the Web Client in version 10.2, in the way they handle template security when secured fields are added to the entry outside of the template.
In the Windows Client, the user is allowed to change the template as long as they can change the content of every field within the template. Fields assigned to the document outside of the template can be read-only or invisible to the user without affecting their access to the template.
In the Web Client, the user is only allowed to change the template if they have access to change the value of every field assigned to the entry. A read-only or hidden field assigned to the entry outside of the template will prevent users from changing the template, even though these fields would not be affected.
This is preventing us from adopting the Web Client because we have values assigned to all of our documents by Workflow, in fields only the Workflow account can change. We are able to change templates in the Windows Client because the fields are not part of the template itself.