When no author, anonymous can view and edit the node

Line 176 of nodeaccess_userreference.module:

<?php
if (!empty($grants)) {
            // Add author grants.
            nodeaccess_userreference_add_grant(
              $grants,
              'nodeaccess_userreference_author',
              $node->uid,
              $data['priority'],
              $data['author']
            );
            // Add all grants.
            nodeaccess_userreference_add_grant(
              $grants,
              'nodeaccess_userreference_all',
              1,
              $data['priority'],
              $data['all']
            );
          }
?>

This is rather presumptuous, specifically

If there are grants set, also add the author and view-all grants.

Who said the author should have all access grants? This gives anonymous users the ability to do whatever they want to nodes without an author. The proper thing to do here would be to check if nodeaccess.module has a setting to allow the author to view / edit / delete the node in question and then set this value, or do nothing at all since nodeaccess handles this already. Or am I missing something?

@brenes I have changed

<?php
// Add all grants.
            nodeaccess_userreference_add_grant(
              $grants,
              'nodeaccess_userreference_all',
              1,
              $data['priority'],
              $data['all']
            );
?>

to

<?php
// Add all grants.
            nodeaccess_userreference_add_grant(
              $grants,
              'nodeaccess_userreference_all',
              0,
              $data['priority'],
              $data['all']
            );
?>

which leaves the default setting so that the author doesn't get grant access, which nodeaccess module already provides via a role (for me). The other thing I would recommend is to uncheck every checkbox on the nodeaccess settings page for "Author may...[view] [edit] [delete]" if you can afford it. Personally, I allow certain roles to administer certain types of content; I have no need for a single node to only be administered by a single user account, but I'm sure others have this need, for example in a community run blog or something. In that instance I think you could allow the author to edit/delete a node and then use some custom code to stop an anonymous user from ever being able to edit any node:

<?php
function mymodulename_nodeapi(&$node, $op) {
  // Always disable anonymous editing.
  if ($op == 'prepare' || $op == 'presave' || $op == 'validate') {
    if ($GLOBALS['user']->uid == 0) {
      drupal_access_denied();
    }
  }
}
?>