I'm fine with the additional check for the anonymous user, but I think we still should safeguard for any users being returned as the original issue suggested (false not being an array) and change

$user = $this->model->getUser($this->access->getLogin());
$user['role'] = $this->access->getRoleForSite($idSite);
$user['capabilities'] = $this->access->getCapabilitiesForSite($idSite);
$users = [$user];
$totalResults = 1;

to

$users = [];
$user = $this->model->getUser($this->access->getLogin());
if ($user) {
    $user['role'] = $this->access->getRoleForSite($idSite);
    $user['capabilities'] = $this->access->getCapabilitiesForSite($idSite);
    $users = [$user];
}
$totalResults = count($users);

Then the rest of the code would work as is.

I'm fine with the additional check for the anonymous user, but I think we still should safeguard for any users being returned as the original issue suggested (false not being an array)

Changing that doesn't hurt. But from a logical point of view, that would mean that you would need to be authenticated with a user that doesn't exist. (Which is only the case for the anonymous user)