they're expecting that the word private means something. Why do you think that an unauthenticated user should be able to read comments of a private group just because they have a URL?
In a world where Facebook and Google have widespread vulns exposed on at minimum a yearly basis, that's their fault for not reading, and just "trusting the computer".
I'm not a chef, but I make sure I know where my food's coming from to the best of my ability.