I believe the rule I put in place is that if the user has permission to view the objects in an album, they can download them as well, unless an admin globally turned off downloading. So, as you noticed, there is not a lot of flexibility for watermarking / downloading for anonymous users. Sounds like a feature enhancement...
Roger Martin
Creator and Lead Developer of Gallery Server Pro