I can't reproduce this.
When displaying any news feed item we run it through the expected permission checks. The relevant one in this case is canViewPostAndContainer
which validates that the visitor can view the post, the thread and the forum the post is in.
Ultimately this checks whether a user has the viewDeleted
moderator permission.
Therefore, if this report is accurate, either the affected users have that permission, or there is an add-on incorrectly overriding something somewhere.