The group type default posting restriction was 'anonymous' which according to your comment would explain why non-logged-in users could post comments.
However either the restriction select box item currently labelled
'Same as for new items' should be renamed 'Same as group default posting restriction'
or when this option is selected, the restriction should not use the group type default but the group posting restriction (which in their case was set to 'logged-in user')

1] If posting restriction for posting new items is 'logged-in users' and posting restriction for comments is 'same as for new', it is still possible to post comments as anonymous. But setting the comment posting restrictions explicitly to 'logged-in users' does work fine.
2] Why is it so that the 'status' field is mandatory at submission of new items while none of the pre-defined values make sense at the time of the original submission? (status configuration setting error?) ... so I set status to 'confirmed' just to get the bug posted.