> For severity, I think you really do want to have end users who hit the
problem to be able to say how bad it is for them
In the comment yes. Letting them to edit the fields is not going to work
though, if you want the severity to have any meaning. Users in general
think their problems to be blockers (for them) or at least critical and
don't read what the severity values are supposed to mean.
Besides, for users the bug reporting should be easy, not showing them the
extra fields makes the bug filing easier (Bugzilla may be a bit
intimidating for first timers).