If you have a private repo, you would assume that nothing in that private repo becomes public unless you do something very explicit.

The issue here is that if you have a private repo and a private fork of that repo. If you make the private repo public and keep the fork private, then you are not explicitly told that your fork is actually public, whether you want to or not.