Yes, that's right. When you change the restriction status of a file in a published dataset, a draft is created. Changes are not visible to the world until the dataset is published.
In Dataverse 5.4 we added* some extra reminders. As in the screenshot below, after restricting a file in a published dataset, you should see this:
"Success! – The selected files have been updated. If it's ready for sharing, please publish it so that others can see these changes."
Hopefully this helps people know that they have to re-publish.
Please let me know if I'm misunderstanding the scenario. I assume you're dealing with a published dataset.
Thanks,
Phil