If I connect DBGEN to '0' on ARM7TDMI, does this disable all debug functionality?

No. It will prevent breakpoints or watchpoints from being set, but it will still be possible for Multi-ICE to put the core into debug state and examine registers and memory. You should not rely on DBGEN as a security feature.

Having DBGEN low is a power-saving feature - turning off the ICE logic reduces power consumption of the core by ~7%. If you wish to disable debugger access to the core, it is necessary to also disable the JTAG interface in some way, typically by forcing nTRST low, or by tying TCK, TMS or TDI to a fixed level within the device. This will prevent any external debug access.