This feature is NOT actually meant for private blogs.
It leaks your feature photos and Ghost @staff have stated that it is actually intended as a “coming soon” feature to protect your blog from viewers until it’s ready to be public. It should NOT be trusted to protect your content (at very least the feature photos of your posts).
More information here: Protect Images and Pictures - #8 by finnhuman.
tl;dr In other words, it is only intended for a “prelaunch phase”, NOT to protect a private friends and family blog or a sensitive internal company blog.