Logged out user can see TL locked categories in Safari

Sounds right. What you’re seeing is the cached page from your machine, which you’ll get if the browser can’t access Discourse. Since they got the data before they were logged out, it’s not a bug. Or so I’d argue.