I didn't word my statement well.
Yes, you can enable unauthenticated requests and you can grant the anonymous role access to the api. I didn't recall `--anonymous-auth` to be true by default.
Makes it easy to find out what clusters are running what versions of k8s which is interesting, but not a major security issue.