From the DBI documentation for $sth->rows():
in reply to Placeholders and Negative Numbers..
Generally, you can only rely on a row count after a non-SELECT execute (for some specific operations like UPDATE and DELETE), or after fetching all the rows of a SELECT statement.
For SELECT statements, it is generally not possible to know how many rows will be returned except by fetching them all.
So $sth->rows() is, by definition, the wrong thing to use with SELECT statements and is not guaranteed to give you the answer you expect. Do as the docs say and count the fetches or else do a separate COUNT query.