But still refuse those on the owner itself, of course.

In Replication 1, some controllers need this kind of hacks which are much easier to deal with in Replication 2 so the simplest is to just align the UNREPLICATE protection with the REFERENCE message received protection, which is more consistent anyway.