'View custom data' permission needed for anonymous user if you want to see it with drush api or php api

Suppose you have a custom field on an address. And suppose you want to get the information in this custom field using the drush api or the php api. Like e.g.

drush cvapi Address.get sequential=1 return="custom_1"

This only works if anonymous users have the 'access custom data' permission. I think this is a bug, because the drush-api and the php api should always have all permissions.

Using the API explorer, this always works, regardless of the permissions of anonymous users.

For some entities (like e.g. Membership), if you don't provide a return parameter, the custom fields are also returned by default, regardless of the permissions of anonymous users. In this case

drush cvapi Membership.get sequential=1 return="custom_44" id=666

does not show custom fields, but

drush cvapi Membership.get sequential=1 id=666

does, which confused me a lot