Assuming you are using a Write-Once media, it does not matter if it is finalized or not. Finalizing just tells the software not to read past this point. Depending on what software that reads/writes, a malicious software can write past this point, and if the target media contains a malicious software that reads past this point, then you are "owned" in hacker's parlance.
I guess you ask this question in the terms "are live CDs really secure when it comes to read-onlyness"
However, burning a CD is a physical process where the actual metallic layer is burnt so it no longer reflects light. Archive media (M-DISC) goes further and actually burns a hole in the reflective layer.
This means it's not physically possible to modify written information. Written information often also have certain check codes (CRC, but it can also be software based MD5/SHA checks) that prevent burning additional marks/holes to modify data.
So a conclusion: If you can trust EITHER the reading device, or writing device, it will not be possible to modify a finalized disk past its finalization.
However, if BOTH the writing and reading devices are dishonest, it's possible for the devices to collaborate to access data outside of finalization sector.
Modification of a unfinalized disk is simply adding data to the disk telling the OS to "No, delete the file xxx.txt and add the file yyy.txt [content of file yyy.txt]" at the end. Which also means that deleting a file from a CD-R/DVD-R will actually waste space on the disk (all modifications to a write-once media is additions), and the file will of course not be deleted, it will be hidden like a file is deleted on a regular hard drive - fully accessible by file recovery tools.
If you want to be 100 % sure that no data ever is written past finalization, you should fill up the disk to the brim, preferable with files containing random gibberish. That's the only 100 % sure option. As an additional security measure, you could for example store SHA hashes of the random gibberish and then verify that the random gibberish is in fact unmodified, upon loading whatever software or files you have on disk.
One usage case of this, is for example if you are going to load a disk of unsensitive data from a high security class, then, verify that no sensitive data in addition to the unsensitive data was written, by using a second computer, and then using a third computer in a low security area to read the disk and for example publish this unsensitive data on web.
If you don't fill the disk with gibberish, there's a possibility that malicious software on the sensitive computer writes sensitive data past the finalization. When you verify the disk on the second computer, you see no sensitive data. Upon reading the disk in the low security area, malicious software might read past the finalization to leak sensitive data.