Still on Drupal 7? Security support for Drupal 7 ended on 5 January 2025. Please visit our Drupal 7 End of Life resources page to review all of your options.
Drupal core's entity reference selection plugin for nodes only allows referencing unpublished nodes if the logged in user has the "bypass node access" permission.