So out of the box, CiviCRM Entity enforces that user has a role with 'view event info' permission to see the rendered entity.
In your case, you could probably just grant anonymous users that permission
This can be modified by implementing hook_civicrm_entity_supported_info() in a custom module, where you can change what permissions are necessary to view entities, or you can specifiy a custom access callback handler
See civicrm_entity.api.php
See https://skvare.com/blog/civicrm-entity-customizing-and-adding-entity-types
Add the functions below to a custom module, replacing YOURMODULE with your module name.
The first implements hook_civicrm_entity_supported_info(). There you set a custom access callback for the event entity. In the callback, check for the view operation, if the event is_public property is not empty, meaning is 1, then check the user has 'view event info' permission. Any other operations and events will enforce 'administer CiviCRM' permission .. you could use another permission, like 'edit all events', or whatever.
UPDATE:
function YOURMODULE_civicrm_entity_supported_info(&$supported_info) {
$supported_info['civicrm_event']['permissions']['access callback'] = 'YOURMODULE_custom_event_access_callback';
}
function YOURMODULE_custom_event_access_callback($op, $entity_type, $entity, $account, $permissions) {
// if $op is view and event is public, check if the user has 'view event info' permissions
if($op == 'view' && !empty($entity->is_public)) {
// see https://api.drupal.org/api/drupal/modules%21user%21user.module/function/user_access/7.x
return user_access('view event info', $account);
}
// For all other ops and non-public events, check for 'administer CiviCRM' permission
else {
return user_access('administer CiviCRM', $account);
}
}