Disabled entries showing up
The code is correct, it was that I hadn't disabled the individual entries in the CMS, I'd only disabled the parent in the structure.

So adding .status('live') on the end of the for loop is the solution, and making sure every entry at all levels is disabled.