"Private" items are misnamed in DSpace. When you make an item private, it does not change the privacy settings (permissions). Instead, it's really just changing its discoverability settings (ability to find it via Browse/Search).
See the definition at:
Private items should likely be renamed to "Unlisted" Items (or "Hidden" Items).
The items themselves are not made private (which implies they are inaccessible except by a valid login). Instead they are just "unlisted" in the browse/search systems, but they remain publicly visible as long as you have a direct link.
I believe this mostly can be resolved just by changing the Messages.properties/messages.xml and the documentation.