Wrong access control for non-workflow CTs

For certain nodes, the exact same node_access entries are created regardless of whether workflow is enabled for the node's content type, or not. As a result, anonymous users do not have access to view non-workflow enabled nodes, even though they have 'View published content' permission.

As background info, there is no other access control modules enabled, devel node access shows 'No - no reason' for anon view permission, and node_access() returns false in the code block where it runs the query against the node_access table, and not anywhere before. I rebuilt permissions with workflow enabled and disabled for the content type, and the same entries were created in node_access in both cases, which looked like these

nid ; gid ; realm ; grant_view ; grant_update ; grant_delete
3136 ; 3 ; workflow_access ; 1 ; 1 ; 0
3136 ; 4 ; workflow_access ; 1 ; 1 ; 1

Apparently, nothing that would grant view access for anonymous. I suspect workflow access module adds these entries because the node's workflow state in workflow_node table persists after workflow has been switched off for the content type. Shouldn't the workflow_node table be cleared when workflow is switched off for a content type?

Is this normal, or am I overlooking something?