Steps to reproduce the issue

Create three menu items;

1. Root level, public access
2. Root level, registered user access
3. Child of the registered user access item, public access
   

Open the frontend of the site, and observe the menu when not logged in

Expected result

The only item that should be visible is the root level, public access item

Actual result

The root level, public access item has a child item that belongs to another menu item.

Additional comments

I am currently unable to test if this bug also exists in 4.4 or 5.0, but unless how menu items are fetched in those versions, I imagine the bug will occur there as well.