Whenever a user connects to an Access database, a locking file is created.
This file has the same name as the database, but with an extension of .LDB
instead of .MDB (or .MDE or .ACCDB or .ACCDE) and exists in the same folder
as the database itself. (and no, it's not possible to change its location)
This locking file is how Access controls concurrent updates to the database.
If a user only had read access, with no write (and create) permission, then
no other user will be able to update the database.
You can leave the database in MDB format, and Access 2007 will then still
support user-level security. It's only in the ACCDB format that there's no
ULS.