I've also done some testing with some other object types (Scripts and Data Actions) and I can confirm that unpublished versions are ignored.
So for consistency with these other object types, the fix required for flows should be:
- Ignore any flows that have never been published.
- For flows that are published, retrieve the YAML content of the last published version (not the last saved version).
I hope this makes sense?