I found what I believe is unexpected behavior.
I limited my Custom HTML widget to trust_level_1. When I’m signed in as a user that is trust_level_0, I do not see the widget. However, when I am not signed in at all, I do see the widget. I would have expected that if a widget is limited to a group, then I wouldn’t see that widget when not signed in. What do you think?