This appears to be quite easy to test and verify how it occurs (tried it on IPS 4.6.12.1)
For my testing, I've just used my own account as the Member and Administrator for ease, but here are the reproduction steps:
Set the 'Can login anonymously?' setting for a group to 'Allowed'
In a private window, login as a member of that group
In a normal window, logged in as admin, view that members profile
Result: User is online now (as expected)
As the member, go to /settings/account-security/ and click the 'Hide my online status' button
As the admin, refresh the screen
Result: User is online anonymously (as expected)
As the member, go to /settings/account-security/ and click the 'Show my online status' button
As the admin, refresh the screen
Result: User is online now (as expected)
Now, set the 'Can login anonymously?' setting for the group to 'Forced'
As the member, refresh your screen or logout/login
As the admin, refresh the screen
Result: User is online now (not expected)
It appears that the 'Forced' setting only works if the member has previously set their status as hidden prior to the 'Forced' being enabled.