I've recently posted an issue to NetBeans that in the case when the Anonymous
user has read access, but nothing else then NetBeans pulgin does not get a 403
error si it would not ask for username/password and the job list could not be
retrieved.

http://www.netbeans.org/issues/show_bug.cgi?id=167585

As Jesse says it would be good to know whether hudson is secured even when
Anonymous can perform some actions.

I guess adding an "@Exported" annotation to Hudson.isUseSecurity() would be
sufficient.