At a guess, private piefed communities don't federate because once content federates, you can't control who can see it. All you can do is hope that the remote instance will follow the privacy settings, but you can't enforce them.

Private lemmy communities don't federate because they don't exist.