There are three separate 8-bit registers
CPU Open Bus - Returned when nothing
is decoded for reading at a particular CPU address
PPU I/O Data Bus - Returned whenever reading any PPU register
PPU Memory Read Buffer - Used only for reading $2007
Reading a write-only PPU register, or reading unused bits of PPU status ($2002), returns the last value written to or read from a PPU register. Even writes to read-only PPU registers will set this value. You can, say, write a value to $2002 and read it back from $2001. This value is stored in PPU I/O Data Bus, called "PPUGenLatch" in the FCEUX source code and "io_db" in Visual 2C02. Physically, this is an octal dynamic latch arising from the capacitance of relatively long metal wires inside the PPU. When reading an actual readable register, that is, $2002, $2004, or $2007, the circuit responsible for that register drives voltages onto this latch. See "Riding the open bus"
for discussion and a test ROM.
The PPU Memory Read Buffer is separate from both the buses. Every read from $2007 copies the PPU Memory Read Buffer to the PPU I/O Data Bus and then refills the PPU Memory Read Buffer. In turn, every read from this or any other PPU register drives the PPU I/O Data Bus onto the pins that connect to the CPU data bus.
On the Super NES, each of the two PPUs has its own I/O Data Bus. This is where you get "PPU1 Open Bus" and "PPU2 Open Bus", as one PPU does sprites and the other does backgrounds, palettes, and color math.