as the title, typing http://domain/arcgis/rest/services/?f=sitemap can load list of services.....
following page content describing that disabling the services directory avoids users browsing list of services seems wrong.
partial content as the following
"....Esri recommends that you disable the Services Directory for production systems when you don't want users browsing your list of services...."
The rest services directory is this:
Using ?f=sitemap is not using the services directory.
Actually you can does this as well even when the services directory is disabled: