If you use only "setcookie()" then, yes, var_dump will show the cookie as still set. But by then your http response to the page request will have caused the user's browser to expire the cookie. So on its next request the browser won't send that cookie. When you use "unset()" you merely erase, on your server, the cookie data that was sent by the browser in its request for the immediate page.
It looks to me like your function should work, and, on the next request, your user will not send the cookies and won't be authorized.
"afaik" = "as far as I know"