Justoverclock when I try as guest I get 400 error invalid parameter as expected.
It's possible all of the Flarum team members have the permission to see everyone's online status. The people who have that permission are not constrained by the "disclose online" setting and are also allowed to use the sort option. By default only admins/mods have that permission on new forums. I don't have access to our admin panel though so I can't verify for sure how we have set it up here.