Here are answers to your questions:
Q1 - Shouldn't I only get the 3 that are published?
You can use predefined filters when query published images:
Q2 - Why are the images uploaded twice?
Q3 - Why don't both images that I unpublish actually unpublish?
var publishedImages = App.WorkWith()
The binary data about an image is uploaded at separate table sf_chunks. Internal implementation of content lifecycle suppose more than one record at database for a content item and it is organized like this:
For a content item depending on the different content statuses it goes through, different records are maintained at database. A content item always has master record which is the primary state of an item (at table sf_media_content the row with status = 0) and it is not visible at UI. When you unpublish an record there is one master record and one record in status draft.
More details about managing content life cycle see user and developer guide:
the Telerik team