Similar to an issue that was reported for the restconf library, I've found that using config false in a YANG model still allows the leaf to be configured through a POST/PATCH request for the Python RESTCONF server. I used the getting started example code for Python, as well as the modified YANG model:
module hello {
leaf message {
config false;
type string;
}
}
I've confirmed that this does not occur with the restconf's Go implementation, so maybe this is an issue with the Python side, or the "getting started" example code is not equipped for what I need.