security - Best practices to assert current_user_can() with guests

In WordPress, a guest can do a lot of things, such as reading posts.

However, this always returns false for guests:

add_action('wp', function() {
    global $post;

    /** @var WP_Post_Type $pto */
    $pto = get_post_type_object(get_post_type($post->ID));

    /** @var bool $cap */
    $cap = current_user_can($pto->cap->read_post);
});

I see that current_user_can() triggers this piece of code for guests:

// wp-includes/user.php @ line 2613 (WordPress 5.0.0)
wp_set_current_user( 0 );
return $current_user;

Thus running assertions on this WP_User object:

WP_User Object
(
    [data] => stdClass Object
        (
        )

    [ID] => 0
    [caps] => Array
        (
        )

    [cap_key] => 
    [roles] => Array
        (
        )

    [allcaps] => Array
        (
        )

    [filter] => 
    [site_id:WP_User:private] => 0
)

Which means it has no capability at all, probably why it's failing.

Given that a guest can actually read a post, why this returns false?

Being such assertions critical for security, how can I assert if a guest is allowed to do something in WordPress, such as reading a post type, or a post ID?