A private relay is not fully ‘private’ until it also restricts anyone’s (other than those who are whitelisted) ability to read the events posted in it. It is only limiting the write permission at the moment.