Audiences are indeed not real security  - anyone with the direct URL to the list
or item (or access to search for it) will see it.

You cannot target  content and group  by date, but you can target a web  part (like
you do in #2) and group by date  within that part  (like #3) which means people
not in the audience  won't see the web part at all, and those in the audience
will see the content  grouped by date.