Of course. If someone shares the link elsewhere and that page gets indexed and crawled by a search engine, then it will obviously become accessible that way.

Thanks to one YouTube flaw, unlisted videos become visible when placed in a playlist.

Is that a flaw or "by design"? I could see this being useful for those who want to only organise videos into playlists without having them "loose".

It seems the whole point of this feature is to prevent the videos from being accessible from inside YouTube itself; whatever happens elsewhere is none of their business, so it could be argued that it is working as intended.