unpublished program nodes are visible to any user

Program nodes that are unpublished can still be seen by any user, including anonymous users.

As far as I can tell, the problem is twofold.

First, hook_access adds a view case:

    case 'view':
      return user_access('access content');
      break;

Second, it has a default case.
According to the comments in node.module (see * @defgroup node_access Node access rights), module implementations of this hook should return NULL.

If I remove the 'view' case, then the switch statement falls out with 'administer programs', which is wrong too.

One quick fix is to replace the 'view' case with this:

    case 'view':
      return NULL;

but it's not very elegant, as the view case should simply not appear in this hook as we're not trying to do anything different to what ordinary nodes do for the view case.