do-ip6 setting stops unbound from sending or receiving DNS queries over IPv6. It does not stop unbound from talking about DNS IPv6 records over IPv4.
From the man page of
unbound.conf (emphasis mine):
do-ip6: (yes or no)
Enable or disable whether ip6 queries are answered
or issued. Default is yes. If disabled, queries are not answered on
IPv6, and queries are not sent on IPv6 to the internet nameservers.
With this option you can disable the ipv6 transport for sending DNS
traffic, it does not impact the contents of the DNS traffic, which
may have ip4 and ip6 addresses in it.
prefer-ip6 controls whether unbound prefers using IPv6 for talking to a DNS server that is reachable over both IPv4 and IPv6, or not.
To block reverse IPv6 queries, perhaps you could do something like this?
local-zone: ip6.arpa. refuse
Blocking forward queries about IPv6 addresses would require filtering out any queries about AAAA records. But a single query can include questions about several record types, and then the software would have to either strip away the IPv6-specific record types from the query, or to reject the entire query.