Sitecore's default crawler (Sitecore.Search.Crawlers.DatabaseCrawler) indexes ALL versions and doesn't handle publishing restrictions. It plain isn't suitable for front end use in live mode out of the box. So how do we fix it?
How I Learned to Stop Worrying and Love Sitecore’s Live Mode
A Passion For Sitecore 