The docs say the required scope is “Any scope”, not “no scope”. In some of v5 endpoints this has meant it does actually require an appropriate token, such as that of the broadcaster, so it is looking for a specific token, just not a specific scope.
Edit: I don’t use Pubsub myself though, so might be wrong, just going on how they’ve worded v5 stuff in previous docs this same way.