When running the "media-filter" on an Item with an access restricted bitstream (file), the extracted TEXT bitstream will be access restricted properly. HOWEVER, the extracted TEXT will be indexed (by Discovery) as publicly searchable.
This means that when you anonymously search content within DSpace, you'll sometimes get results back from access restricted files.
See this dspace-tech thread for more info:
It seems that Discovery is just not paying attention to any access restrictions on Bitstreams, it only checks access restrictions on Items.
This bug is also briefly mentioned in DS-2256, which is only loosely related.