If the you are assigning the levels to groups and the groups have have the same people in them, then yes that's the problem. Each level will need different people assigned to them to have different results. Customers that should be able to edit need to be in a different group or project role, and then that group/project role used for the Customer Edit security level instead of the group that contains all customers.
Security levels have nothing to do with anything that someone might do with an issue other than their ability to see them.
You need to be looking at the permissions in the project - they control the edit (and transition, and assign, and comment, and and and) abilities.
Security levels simply hide issues from people not defined as being in the level.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.