Not quite sure this is a bug persay, but if we send a field update to a draft collectiontype without specifying that it is a draft collection type (&status=draft) then we will find that it is automatically published.
This is workable around, but just is a fairly unexpected result that if we send a packet to update a collection through the RestAPI but aren't explicitly setting the Draft state, we may accidentally cause articles to be published.
It'd be much better if changing the publishing state of an article always required an explicitly argument in the rest call.