Is a private pit really private?

Yes. Private and unlisted pits are excluded from public listings, search and the sitemap, and access is enforced at the database level with row-level security, not just hidden in the interface.

The anonymous client the site uses for public pages physically cannot read a private row, so a private pit cannot leak into a feed or a crawler even by mistake.