If you put an ACL on a product, that product can no longer be found using search or browsing through the category even though the Catalog Settings are configured to 'Ignore ACL rules (sitewide)'
At the same time the product can still be accessed directly if you know the URL.
I realize that this type configuration in itself is inconsistent and therefore this could be regarded a minor issue. Still I thought it might be worth noting
From what I've seen taking a glance at the code it seems that the products for the category are gathered by a stored procedure that honors Customer roles. On the other hand directly accessing the URL of the product honors the Catalog Settings where 'Ignore ACL rules' is set and authorizes the request.
We're using NopCommerce 3.40