[rsbadger]

AFAIK, most of those "private" links are actually just "unlisted" but they're still public. I'm sure Bing is indexing those too...

[Gigachad]

Anything private should ideally be put behind authentication. If that isn't possible, than robots.txt. Search engines are _meant_ to index everything that is publicly accessible and not blacklisted on robots.txt.