This is really weird. I created a Lemmy server to test with and I have the instance set to private:
I created a few posts on my server with images. I expected the images to only be viewable if signed in however I can see them even when I'm not signed in. I'm not sure what is wrong.
Update: Oh it looks like if I upload the image with a non-admin account it works. I will look into the issue tomorrow.