When user does logout and gets homepage for guest user, after page refresh (F5) user gets full page like he is logged in.
If there is Login Joomla module on homepage (published or unpublished) on homepage this does not happen. The moment that module is deleted, user can access full site on refresh.
When there is no Joomla Login module and user does logout with JomSocial button (JomSocial toolbar menu item or JS Hello Me module) there is change in *_sessions table in database and user looks like he is logged out. But, on refresh user is presented with full site access while *_sessions stays the same, and Joomla dashboard (LOGGED-IN USERS part) shows no front-end logged in users. Even Joomla modules, like Search, that should be shown only to Registered, show up.
CFactory::getUser()->isOnline() ... on logged out user returns null in this scenario:
[_avatar] => [_cover] => [_isonline] => [_view] => 0
Now it seams that even with Joomla Login module present after logout and few F5 refreshes user is presented with full site not guest.
JomSocial 4.4

This is intended behavior?
github.com/joomla/joomla-cms/issues/11866