Unpublished pages are visible by anonymous users!
It happens when anonymous is added to the grant tab and given to content that is unpublished.
You shouldn't set up the site this way, but if you did accidentally, it's not as simple as removing anonymous from the grant tab (permission seems to persist).
The patch in this issue fixes it.
Issue module