If your're signed in as an editor you will also see unpublished content.

And yes, you have to check publish status and access rights if you're working against IContentLoader directly.

You would generally filter the content returned from IContentLoader to make sure it's suitable for site visitors. In most projects I work on we'll have a content filtering interface and service like the example below:

using System.Collections.Generic;
using EPiServer.Core;

public interface IContentFilterService
{
    IEnumerable<T> Filter<T>(IList<T> contentItems) where T : IContent;
    IEnumerable<T> Filter<T>(IList<T> contentItems, bool checkPublished, bool checkAccess) where T : IContent;
}

using System.Collections.Generic;
using System.Linq;
using EPiServer.Core;
using EPiServer.Filters;

public class ContentFilterService : IContentFilterService
{
    private readonly IPublishedStateAssessor publishedStateAssessor;

    public ContentFilterService(IPublishedStateAssessor publishedStateAssessor)
    {
        this.publishedStateAssessor = publishedStateAssessor;
    }

    public IEnumerable<T> Filter<T>(IList<T> contentItems) where T : IContent
    {
        return Filter(contentItems, true, true);
    }

    public IEnumerable<T> Filter<T>(IList<T> contentItems, bool checkPublished, bool checkAccess) where T : IContent
    {
        var list = contentItems.Cast<IContent>().ToList();

        if (checkPublished)
        {
            new FilterPublished(publishedStateAssessor).Filter(list);    
        }

        if (checkAccess)
        {
            new FilterAccess().Filter(list);    
        }

        return list.Cast<T>();
    }
}

Hi,

Yes, as Johan said, the content returned will depend on the current user's access right. 

We have a static class (EPiServer.Filters.FilterForVisitor) which provides some methods to help us quickly filter contents which are not supposed to be shown to current end user.

Regards.

/Q