Private posts do show up (with a ‘private’ label IIRC) in the feeds. I don’t think it’s ideal, but it’s what you should expect.
I disagree that this is the behaviour one should expect. The documentation says:
Posts marked as “Private” are not visable to any other authors regardless of user levels.
This wording strongly implies that a post that is marked “private” should not be visible to anybody but their original author. So, I do agree it should be considered a bug; I guess I should go and file it as such.
Meanwhile, thank you for the clever work-around suggestion of filling in the Excerpt field; I had not thought of that.