If the user can create, then you give him write access as well. Because when you create a record, the write method is called too. You can check this by adding a print to write and try then to create a record.

But why write is called too? What is the point to have crate and write access splited up in that case? I want users only to create new ones and not to edit existing ones (because then they can change admin passowrd).

You could hide the admin user from the other users, overriding the search method of res.users, you can use self.env.user.id == SUPERUSER_ID then append to the domain ('id' ,'!=', self.env.user.id).

But you should verify your logic, if you create an user, you should be able to edit that user.

Sorry, the condition is if self.env.user.id != SUPERUSER_ID then append to the domain('id', '!=', SUPERUSER_ID)

But where do I put this?

And I need to protect not only one superuser but also other users with high privileges. I simply don't want users to edit others with the same or higher privileges. And the simples solution would be to deny write access but odoo is broken and calls it when it shoudn't.