The obvious answer is just to allow bugnotes from authenticated users.

I think it would be much more obvious to just prevent guest from editing posts.

As this is still not fixed in 0.19.0, I want to put that on top once again: I fixed this now for myself in my installation, but it's really only one "(!current_user_anonymous)" in bugnote_view.inc, so why don't include it in the main distribution?