I'm using OG, 'OG user roles' and 'OG user role access' modules and different permission levels per node type per OG.

If I convert a node in one group to a type with more restricted accesses, then publish the node in a different group as well, it will be visible to all members of that second group.
It should however be visible only to specific user roles inside either group.

My suggestion is to use node_access_rebuild(TRUE); in batch mode to fix that potential security problem.