"Beginning in February of 2018, communication over DigitalOcean Private Network IPs will be isolated within the account or team where they were created"

Great news, definitely a step in the right direction. The fact that DO's "private network" isn't really private is something that's not very well known I think (try googling for the topic).

Until then: Use DO firewalls to whitelist only the services connections you want. Their firewalls treat private and public networks equally -> no more publicly accessible NoSQL databases :)