They can't right now as:
 * The Push API will not allow anonymous users to register for a feed.
 * The REST API will not allow requesting data from anything other than principals

That said, this is obviously a bit brittle. I'll add the necessary checks and tests.

Which activities shouldn't be seen by anonymous users/non-members btw?