the "latest content" and manual blocks ignore the visibility of objects. so if an article is showing and then is hidden in admin, it is still shown in the block. no clear caches, run the cronjob or even republish of the frontpage will have any result.

the permissions from anonymous user are not being checked, according to documentation:
http://doc.ez.no/Extensions/eZ-Publish-extensions/eZ-Flow/eZ-Flow-2.5/Configuration/Configuring-the-eZ-Flow-block-system

since in ezFlow documentation is clearly stated that the Anonymous user is used for populating the content of the block, ezFlow is skipping over the permissions. when the link is clicked on a hidden object, then the permissions work as usual and the objects is not displayed.