TYPO3 Core

That's correct.
Because of the long time ago, I'm not sure if I was logged out from backend - but I think I tested it in a second browser - the link was still working in Frontend.

I can reproduce it on TYPO3 v12.4.9.
The mount point has mount_pid_ol=1 set.
Disabling the mount point page (hidden=1) still makes it accessible in the frontend. It does not appear in menus, though.

Steps to reproduce:
1. Create normal visible page
2. Create page of type "mount point", configure mount_pid_ol=1, hidden=0 and mount_pid to the ID of the first page
3. View mount point page, it shows the contents of the first page.
4. Disable mount point
5. View mount point page, it still shows the contents of the first page.

Workaround: Register a listener for AfterPageWithRootLineIsResolvedEvent event:

<?php

namespace Mogic\Dbi\Frontend\EventListener;

use TYPO3\CMS\Core\Utility\GeneralUtility;
use TYPO3\CMS\Frontend\Controller\ErrorController;
use TYPO3\CMS\Frontend\Event\AfterPageWithRootLineIsResolvedEvent;

/**
 * Send a 404 when the source mount point page is hidden.
 * Workaround for TYPO3 bug #59225.
 *
 * @link https://forge.typo3.org/issues/59225
 */
class HiddenMountPointEventListener
{
    public function __invoke(AfterPageWithRootLineIsResolvedEvent $event): void
    {
        $params = $event->getRequest()->getQueryParams();
        if (!isset($params['MP'])) {
            //not a mount point page
            return;
        }

        list($targetUid, $mountPointUid) = explode('-', $params['MP']);

        $tsfe = $event->getController();
        $page = $tsfe->sys_page->getPage($mountPointUid);
        if (!empty($page)) {
            //mount point source page is available
            return;
        }

        $response = GeneralUtility::makeInstance(ErrorController::class)->pageNotFoundAction(
            $event->getRequest(),
            'The requested page does not exist!',
            [
                'hidden' => [
                    $mountPointUid => true
                ]
            ]
        );
        $event->setResponse($response);
    }
}