I thought I had the same problem with pages being public although saved as draft. But I have found out that it is only when I am logged in as admin and opens my main site in a different tab that it looks as though draft pages are public. As soon as I log out, the various draft pages show me a “Not Found” message.