Restricted access until activated by admin

When Moderated Registration is enabled, users must be activated prior to having any access.

https://rocketgeek.com/plugins/wp-members/docs/registration/moderating-registration/

When have that box ticked, log out, create a new user, I still have full access to all pages, from the point I login with the new user.

I have woocommerce and the new user sign up on the woocommerce sign up page, is that what is causing the problem perhaps?

If you’re talking about content that is part of WooCommerce (shop, product, etc), then that’s why the content is not blocked. WC uses its own Loop outside the WordPress Loop. See this topic for more info: https://www.ads-software.com/support/topic/block-woocommerce-pages/#post-9130101