Through some further delving into the code and random experimentation, I found that if you comment out the following line:
Code:
define('SKIP_SESSIONCREATE', 1);
...then the feed appears to work as expected for logged in users, while returning a blank page (as expected) when not logged in.
Has anyone else used this method? Have you found any behaviour that I should be aware of?