1. I am wondering where you have found this code. We have no such code in the latest release version.
2. There is no logical bug at all - we have a format of what is needed to be set in order to run closed forums. So, setting an empty array of forum users, you are allowing every user to see them. That's more than logical, because it is inclusive array, not exscluvie.
Your piece of code will work, when you set $clForums, but do not set $clForumsUsers at all, either create an empty array of them. This is not our format and in this case, you need to fix also another places, when the checking of closed forums exists.
In general, it is even not clear, why do you need to create a closed forum, where nobody except admin has access to.