What determines who can view an unpublished node?
It is handled by node_access:


it checks for the "view published content" - without this permission every operation is denied, published or not.
it checks the view own unpublished content permission.
it checks if hook_node_access gives either deny/allow. If not...
If no module implements hook_node_grants then there's a default allow for published nodes (and therefore a deny if not).
If modules do implement hook_node_grants then the node_access table is consulted. I found that published content receives a "default grant" in the node_access table thanks to node_access_acquire_grants, meaning anyone can view it. Unpublished content has no default grant so is therefore denied.