Private worlds in VRChat are really only unlisted, they can have public instances and group instances like any other world despite the game and the website not allowing this.
A player with a link to a world can make any instance type (regardless of the publish status) using the API. This is especially easy with third party tools such as VRCX.
I propose two solutions:
Change the Private status name to Unlisted to let creators know the world is fully accessible via the link and any instance type can be made (website, in-game, or api).
OR
Server side block public and groups public instances for private worlds.