And did you tie a Resource Policy to this Resource Group and a specific User Group within the Context the Resource is being accessed in? If not, you have done nothing to prevent it from being accessed by anonymous users.
I have a page with access permissions checked for resource group "Members", but the page is still available for everyone unlogged.