Node reference shows as empty to anonymous users
Found it!

I'm using Organic Groups on this site, and I didn't realize that you could grant access permission (view/edit) on a field level (contrary to the base Drupal permissions system, which works only with content types). Since it doesn't show up on the "normal" Permissions page, it's easy to miss. (It's in configuration > Organic groups > OG permissions overview).

So it was indeed a simple configuration issue.