Since I upgraded from 2013-05-10a "Weatherwax" to rc2013-10-28 "Blinky" the sitemap became visible to @ALL, though the ACL for * for @ALL is set to "none".
The page
https://www.dokuwiki.org/sitemap says "Note: the sitemap will only contain pages that are readable by the public without logging in.", which isn't true for version rc2013-10-28 "Blinky".