Someone kindly pointed out the update in Winter 20: The security model of a 'guest' user was changed by Salesforce, most recently in Winter 20. learnexperiencecloud.com/s/article/… is a good reference – identigral
I just needed to set up sharing rules for guest user profiles on the related objects https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/security_sharing_rules_guest.htm
Here's what my rule looked like: