Unpublished products are not hidden

I'm not terribly familiar with Commerce, so can't say for sure, but if products are a different entity type, not normal nodes, then the "Content access" processor won't work on them.
To exclude unpublished products, add the "Published" field of products to the index and then filter on it. For also displaying nodes, you can either use an "OR" filter group to do "Datasource: Node OR Product published: Yes", or add an aggregated field for "Published" of both products and nodes and filter on that. (In the latter case, even admins won't be able to find unpublished nodes, though, which should currently be the case.)