"It's pretty much universal for comments to have the same visibility as the item to which they are attached."

But Buzz does not even quite work like that. Any commenter can extend the visibility to one of his contacts (a totally different set from the author's contact) by adding a @ reference to them in a comment. So even the author himself does not completely control the access rights.