After reading the Roles and Capabilities article I can see that the Subscriber role has read capabilities only. What capabilities (if any) would be assigned to an unauthenticated user? i.e. a website visitor browsing around but not logged-in.
Visitors have no capabilities. Not even the capability "read" which seems a bit odd to me.
Every user (loggedin or visitor) has the
exist hardcoded capability.
See line 745 in the source example.
Not logged in users have no other capabilities unless coded in a plugin or theme.