Resolved
The main blog of the site had the plugin BuddyPress Members Only installed. The unintended consquence (and possible bug) was that subdomain site's also required logins.
This problem was solved by Network deactivating BuddyPress Members Only.