I have a set of users that have custom privileges set so that they can create & view records in a table, but they are prohibited from editing the records.

If the user is browsing records and attempt to edit a record, they are prompted with a proper error message that they do not have sufficient privileges to edit the record.

However, if they create a new record, they are subsequently able to edit the record until they log out of the database.

Is this how the restriction is "supposed" to work?

It is supposed to work just the way you describe it.

If you want to block editing after the record is committed, including in the current session, change the edit privileges from "No" to limited and set the value there to be 0.

Steven