I have AutoCommit set to OFF (as shown by the icon in the bottom-left of the screen) and I do not have the AutoCommit checkbox set in Tools->Options->Database->General (Commit after each statement in Editor mode).
If I issue an UPDATE command, I can see the changes with a corresponding SELECT statement. If I then type in ROLLBACK, the messages pane says that 1 row was affected, but the data has been committed nonetheless (as evidenced by the same SELECT statement). Closing and re-opening Toad has no effect. The data has still been updated.
Could someone please verify this before I enter an SR ticket? This is a potentially dangerous oversight.