Does @withSubscription not work yet with @auth rules?

Yes, thats available on Slash GraphQL and also master, 20.07.1 release.