Are there security-issues with a read-only-account on Oracle-DBs?
Yes, there are.

every account puts load on the server and has the potential to bring it down by overloading it with silly queries or sometimes just bad luck.
more and more important: privacy issues. When a company leaks data they can get serious fines.
company secrets can be stored in the database. Leaking them does not help their case.

control and audits are getting more and more important.
A solution can be to have a copy system in place that generates an adhoc query database that is de-personified enough so privacy concerns can be remedied. It also alleviates the production host from the load caused by the research queries.
A controlled reporting tool can also be helpful, I just don't see how that mitigates privacy concerns other than having predefined reports that just don't show personal data.