2.32.2. Set up Jenkins from the setup wizard. Install matrix-auth and configure admin to have everything but anonymous to have only discover, and Save. You will see config.xml as expected:
Yet after restart if you revisit /configureSecurity, in the UI and reality, anonymous is granted Item.READ.
Seems that the
JENKINS-2324 workaround is incorrectly being applied, since Jenkins.isUpgradedFromBefore is broken, since version on config.xml is still 1.0!
Workaround is to go to /configure and Save.