To complete the scenario documented in https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-restrict-user-data, the "disableKeyBasedMetadataWriteAccess" account property must be set.
Update-AzCosmosDBAccount does not accept a parameter for this and does not internally operate on this property.
The corresponding Azure CLI command does expose this argument (disable-key-based-metadata-write-access) and allows for this account property to be set:
https://docs.microsoft.com/en-us/cli/azure/cosmosdb#az-cosmosdb-update