the default home page will be accessed by all user roles until a rolebased homepage is defined.
Not limited to security settings.
Although, the moment you add data to the homepage, all userroles using the default homepage, must have at least read access to data shown.