Situation:

I setup bamboo with the global permission 'Access' for 'Anonymous users' disabled.

However, if you create a new plan and allow access for 'Anonymous users' in specific plan, users that are not logged in can still access the project.

IMHO the plan specific permissions should not override the global permissions. We do want our developers to create new plans, but we don't want them to bother with the permissions.