By default, it’s:
# Which fields may be changed by regular users using chfn(1) - use
# any combination of letters "frwh" (full name, room number, work
# phone, home phone). If not defined, no changes are allowed.
# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
#
#CHFN_RESTRICT rwh
Considering the aforestated: [1]
If not defined, no changes are allowed.
…why is it not CHFN_RESTRICT frwh by default, which does work?