When anonymous (and other) users are allowed to view the book, they can see also UNPUBLISHED book nodes. Is that correct? I think that published/unpublished principle should have priority.
---
In this situation, the devel_node_acces module debug shows:
Anonymous user: view: YES: {node_access}