Currently, SecurityAssistant isn't checking if the global 'allow anonymous users' permission is enabled. It is just checking the specific space. Normally this isn't showing up since anonymous users can't access the site anyway, so macros won't get executed. However for other plugins which allow access via other means (eg WebDAV, XML-RPC) this will be a problem. Confluence 2.x versions should probably hand off responsibility to the PermissionManager. 1.4.x will have to check manually.