The root of reference tables is handle by a different controller than the reference table leading to incoherent result.

For example, consider the following assignment for the Reader profile :

When checking the read access for anonymous on a entry of type A (or a subType of A) the expected result is Any connected Allowed (as visible in the assignment tool).
But the actual result is Any connected denied (as visible in the explain right tool)