When I enable the Node Privacy By Role module, anonymous users are able to download private files. These users do not have the access content privilege, so should not be able to access the files in question. My site started in Drupal 6, and has been upgraded to Drupal 7. The steps I've gone through that produces this error are:

1) Create a File Field on a content type. Make sure this uses the private file access method. Create a node and upload a file.
2) Make sure anonymous users are set up without the "View Published Content" permission (on my site, anonymous users actually have no privileges at all).
3) Obtain the url for the file uploaded in step 1.
4) Log Out of Drupal, and try to access the URL - I get the Access Denied Message as expected.
5) Install the Node Privacy by Role Module, enable it and Rebuild Permissions.
6) Log Out of Drupal and try to access the file by it's url again. The file is now downloaded, no access denied message is presented.

The module seems to work fine for nodes.