Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.
When creating a new project from an Issue Tracking project template (and I assume, all XML templates) there is no permissions defined at project level at all so only project administrators have access to FRS service.