My colleague and I were reviewing the Apex Class Security Overview.
Per our understanding of the page, if a user does not have permission to access VisualForce page's controller, he should not be able to view the page.
But then we create a page with a very simple controller and upon experimentation found that it didn't matter whether the User had any permission's related to the controller, but rather whether his Profile gave him permission to view the page itself; once he had this, controller permission was irrelevant.
So it is clear that either this page is inaccurate or outdated, or we don't understand it correctly.
Can anyone explain this topic better?