In my org, Sharing settings of Case object is "Public Read Only". So only case owner or those users who are part of Case team can edit the case record.
All the users have Read, Create, Edit access to the Case object at the profile level.
Now, when an user try to edit the case which other user's have ownership and he is not part of case team, then it is showing "Insufficient Privileges". That is perfect!
But that user can add the case comments in that case.
My question is how sharing of Case Comment works? Is that Public Read-Write? I think it should inherit the sharing from Case.