Over at #1890906-4: Information disclosure: Project* is not properly allowing node_access to work on listing queries in D7 drumm mentioned:

Project module does assume standard SQL storage in a few places...

If so, that's a bug we should fix separately, so I'm opening a new issue about it. After asking for clarification he said:

At some point last year we became more sloppy about shortcuts to just get Drupal.org upgraded. A few things that stick out from git grep -nE 'db_(select|query).*node':

usage/includes/pages.inc:124:  $query = db_select('node', 'n')
usage/includes/pages.inc:245:  $query = db_select('node', 'n')
release/metrics/ProjectReleaseMetric.class.php:27:    $projects = db_query("SELECT DISTINCT(nn.nid) FROM {node} n ...

This does look a lot better than I had assumed.

I was under the impression that even if you're using a non-SQL field storage engine, that {node} itself was always supposed to live in SQL. So, I'm not sure these are even examples of assuming SQL field storage.

I think this requires more investigation, but I wanted the discussion to happen in a separate issue.

Thanks,
-Derek