The Portlet Spec defines something it calls "expiration cache" which a portlet container may implement. Apparently, we are only implementing the JSR-168 variant right now and not the JSR-286 one. With the Portlet Spec 2, two major things were changed:
1) The introduction of a cache scope. Right now, we put the portlet output in a user's session for caching purposes which means that we cannot share cached output across multiple users (let alone anonymous users). So, while we "support" the private scope, we're not dealing with the public scope at all.
2) While Portlet Spec 1 says that a portlet container should discard the cache whenever a request is targeted to a portlet, Spec 2 recommends to this only in "an action-type semantic (e.g. an action or event call)".