Thanks for raising this topic!
I have considered deanonymisation attacks and you’re right - user group inheritance is not a tool for everyone and is especially vulnerable for instances with high cardinality group affiliations. As detailed in the PR, the original concept to support anonymous posting in regional groups, which will be implicitly low-cardinality in our instance.
edit: I’ve added a group attribute called anonymous_user_inheritance, which allows admins to choose whether or not the group gets inherited by anonymous users. I’ve also added a warning next the admin setting to enable the feature, and I’m open to any further suggestions.