Audience required, but able to create content anyways

Latest og.module, audience required, authenticated user, allows creation of content with no OG intervention.

This might help: the same issue w/ an older (8/15 or so) version of the module -- the Audience fieldset did not display, even though that version of OG didn't allow for it to be turned off.

If others can confirm this, I'd say this is indeed a critical bug.