After reading the Roles and Capabilities article I can see that the Subscriber role has read capabilities only. What capabilities (if any) would be assigned to an unauthenticated user? i.e. a website visitor browsing around but not logged-in.
Every user (loggedin or visitor) has the
exist hardcoded capability.
See line 745 in the source example.
Not logged in users have no other capabilities unless coded in a plugin or theme.