There are many places in Opc.Ua.NodeSet2.xml where nodes contain configured role permissions.
Actually this issue contains two parts:

1. Usage of role "Anonymous" (i=15644)

2. Explicite assigned permissions for specific roles

3. Usage of role "Anonymous"
   At many places specific permissions for role "Anonymous" are defined (in most places just browse, but sometimes also read or call).

E.g. node ServerConfiguration (i=12637) and its properties:
Permissions for role SecurityAdmin and ConfigureAdmin allow almost everything
Anonymous is allowed to browse.
=> Why should the role "AuthenticatedUser" have less permissions than Anonymous?

The same is valid for all other nodes, where explicite permissions are defined for role "Anonymous"
Most ridiculous is the "Call" permission on method "ChangePassword" for anonymous users.

Was the intention to permit e.g. "Browse" to all other roles?
In this case I would suggest an additional well known role "AllUsers".
This role can be assigned to all session and thus such a configuration would be possible.

2. Explicite assigned permissions for specific roles

Again node ServerConfiguration (i=12637) and its properties:
Permissions for role SecurityAdmin and ConfigureAdmin allow almost everything
Why is the role "ConfigureAdmin" allowed to change server configuration?
In specification this role is mentioned only in part 3 with "The Role is allowed to change the non-security related configuration settings."

Similar for "PublishSubscribe" (i=14443).
Here only Anonymous and ConfigureAdmin have any rights configured.
All other roles are not even to browse - more related to 1)

In general I would suggest that RolePermissions (for almost all nodes) should be configured by application.
If any nodes shall be hidden (e.g. for security resons), then this shall be stated explicitely in specification.
This make sense e.g. for TrustList (below ServerConfiguration - CertificateGroups - ...)
This information should be hidden exept for specific role "SecurityAdmin".
Such an information is stated for "SessionSecurityDiagnosticsType" in specification part 5 - but not for the other nodes with role permissions assigned in NodSet2.xml

Other places in part 18 are more ambiguous " shall provide user credentials with administrator rights like SecurityAdmin Role".
=> Either state explicitely a role which is necessary to get permissions or remove RolePermissions from NodeSet2.xml