Discovered while testing EZP-27508, however not a bug of that feature, but rather of the way publishVersion and related UrlAliasService method work.

Basically if the Draft to be published got removed some language (possible since EZP-27508), the UrlAliasService won't remove it from the language_mask column in the database, so front-end URLs that should return 404 return some fallback version of a Content.