The 'Hidden or Live' status does not prevent a user from viewing the page if they happen to know the exact URL. The intention of this feature is to 'hide' the page from showing up in the site navigation.
If you need to insure that users are unable to view the page at all, then you should set the security group to 'Administration'. This will force an administrator sign-on in order to view the page. If you set the security setting to 'no access', even those with administrative credentials will not be able to view the page from the public side.
