The withdraw command makes an onchain transaction to send a given amount of onchain funds to the specified destination. It will not close any channel beforehand to withdraw funds locked there.
Whether or not it will sweep unconfirmed UTxOs as well is specified to the command via the minconf optional parameter, which can be set to 0. See the manpage for more details on the usage of the command.
So, yes, by default it refers only to UTxOs with the status field set to confirmed in listfunds. Note however that withdraw <addr> all will not sweep the reserved UTxOs (those with a reserved_to_block block field superior to the current block height in listfunds's result).