Read ACLs restricting user roles from reading task fields such as work notes are ignored by the Live Feed module, allowing then users to view hidden fields on messages posted on the incident feed.
This is by design in order to optimize performance.
Live Feed does not evaluate the base record's ACLs. Instead, it relies on whether the user is an admin user or a normal user.
When a user clicks Show Live Feed and becomes a member, the membership of admin or normal user is determined based on whether the user has access to the work notes or not. So, changing the ACLs does not affect any existing data.
It is recommended to also change the membership of all the existing records in live_group_member from admin to active for such users who are not supposed to see the work notes based on new ACLs.