Guest user should not be able to modify anything except explicitly set permissions.

I would say that guest user should not be "each user". It is normal behaviour in all systems that guest account is used for readonly non-destructive access to the system. 

There should be probably next permission to check/uncheck if given user can add anything or not. And in default setup, guest user should not have these permissions. In other words, guest user should not have ability to modify/add/remove anything in system except data in its own session unles it is explicitly granted by admin for guest user.