In Salesforce orgs created on February 8, 2024 or later, after you enable digital experiences, records shared with the Roles and Internal Subordinates group through sharing rules or other features remain accessible only to those internal users. In orgs created before February 8, 2024, records shared with internal users are still made available to external site users automatically, and you must use the Convert External User Access wizard to secure access.
Where: This change applies to Aura, LWR, and Visualforce sites accessed through Lightning Experience and Salesforce Classic in Enterprise, Performance, Unlimited, and Developer Editions.
Why: For orgs created before February 8, 2024, the previous behavior is applied when you enable digital experiences, so that records shared with the Roles and Subordinates group are automatically shared with Roles, Internal and Portal Subordinates. To secure your org’s data, you must remove access for external users with the Convert External User Access wizard and manual updates.
Record Access Is Secure by Default after Enabling Digital Experiences (salesforce.com)