How to remove private posts from RSS feeds?

The same way you would change which posts WP shows on any other screen, pre_get_posts! If you ever see WP pull in posts, and want to modify what it fetches from the DB, use the pre_get_posts filter

E.g. something similar to this:

add_action( 'pre_get_posts', function( \WP_Query $query ) {
    if ( !$query->is_feed() ) {
        return; // this isn't a feed, abort! 
    }
    $query->set( 'post_status', 'publish' ); // we only want published posts, no drafts or private
} );