The access model that matters is not login — it is what an anonymous reader can reach by guessing a URL.
Every newsroom needs a way to hide work in progress. Most implementations hide it in the listing and forget the detail route, so an unpublished piece is one guessed URL away from being public.
The test is not whether the list omits drafts. The test is whether a request for a draft by its own identifier returns a 404 to someone who is not signed in.
We verified both: the public listing returns published items only, and a direct request for a draft identifier answers 404 rather than an empty body with a 200. The difference between those two responses is the difference between a hidden draft and a leaked one.