Horrible permissions bug, anonymous users can edit products
Node access rights can be a little hard to debug.  You need to enable the Devel module, and the Devel Node Access submodule.

Then goto your block configuration.  There will be two new blocks: Devel Node Access and Devel Node Access By User.  Add these to your page, and configure them for your admin role(s).  Also goto the Devel settings (admin/config/development/devel) and enable Devel Node Access debug mode.

Then visit a page with access problems.  Look at the debug info.

The Devel Node Access block will show you the {node_access} rows for the node in question.

The Devel Node Access By User block will show you who has permission to do what, and why.

Then you need to do some sleuthing.  If it is a permission, then you need to find that permission and edit it.  If it is a hook_node_access(), then you need to find the module that is implementing it.  If it is a grant, then you need to use the realm/gid and track down who is implementing a hook_node_access_records() with that pair.

The module_implements() function can be used to track down who is implementing what.  I typically do this with

drush php-eval 'print_r(module_implements("node_access"))';
drush php-eval 'print_r(module_implements("node_access_records"))';


My guess is that one of your features has a rogue hook_node_access() in it.  You could also try disabling your features one by one and seeing what happens.