I've done testing with private and unlisted profiles, and MyHeritage picks them up. I've reported it more than once, to no avail. It seems the best answer I can get is that I am wrong, despite providing examples of the issues or that it's okay because I was logged into WikiTree when I accessed MyHeritage. As a software engineer, I know how it works, we think the user is wrong, we think we know the code so well that a "that" bug couldn't possibly be happening, etc., etc. It's easier to say it's a user problem than to debug an issue.
Also, like I said in my answer, in addition to the private and unlisted profiles themselves, original documents and photos that are private, on private and unlisted profiles are grabbed my MyHeritage as well. These are not thumbnails like the little PDF icon, nor any thumbnails of a public profile image. These are the actual documents and the actual, full-sized images that were not profile pictures.
I used to have all kinds of documents and photos on my family's profiles, but I had to remove them all as the privacy I've selected is not being honored.
It's best to warn people that anything posted on the internet, not just WikiTree, has no guarantee of privacy. While I'd love to say that WikiTree's privacy is 100% guaranteed, that would be a statement misrepresenting something that is unattainable. Nothing connected to the internet is 100% safe from someone finding a way to access it through brute force or taking advantage of known bugs in server and database software.
I love WikiTree and promote it all the time, but I also think it's best to know the issues with any software I use.