auth.uid() is null: the Supabase RLS policy that lets signed-out visitors read everything

A policy like auth.uid() is null or user_id = auth.uid() looks like an owner check but gives every signed-out request every row. Why it happens, why scanners miss it, and how to fix it.