The comments RSS should only provide comments for posts that are actually visible after filtering. To see the problem:
1. Create a plugin that uses the the_posts hook to filter the list of posts. Have it return an empty array.
2. Look at http://www.example.com/blog/comments/feed/ and you will see all your comments for supposedly filtered posts.
If you don't want to create a plugin, you can use my category access plugin: http://www.coppit.org/code/category-access-0.5.3.zip. Just set the default access to none to restrict all posts in all categories.
I believe the solution is to modify the SQL in wp-commentsrss2.php, adding a WHERE clause that restricts the query to only those posts that are returned from the_posts.
