how many times does this tester need to be told they can't change a primary key

I mean, you could change the primary key.

Would you have to refactor literally the entire app and database schema and potentially even underlying hardware? Yes.

But you could change that key.

@HiFiWiFiSciFi Depends on how they are trying to change it.

Since its a tester I assume they are trying yo change the value but OP does not state if this fails due to foreign keys and the tester considers this a bug or succeeds and breaks the application.

If a tester should not do it, then they should not have the ability to. If your testers do it, can customers too?

Your tester found either a security or a usability issue.
The primary keys should be automatically assigned IDs. They are not to be shown in the UI and therefore there should be no indication of changeability.

If the tester sees them in the UI or found a way to change them - that definitely is a bug.