Permissions do not carry over to cases like you would think. There is an existing idea around this here:

https://success.salesforce.com/ideaView?id=08730000000BpYo

Currently, administrators can assign granular permissions to cases -- read, create, edit and delete. These permissions do not, however, carry over to case comments. A user with read-only access to a case can still add comments, public or private, which can trigger an email to the customer and disrupt support processes. The only way to prevent a user from adding a comment or toggling the private/public flag is to remove all access to view the case. I propose that either a) case comments inheret the permissions from cases, or b) have their own set of permissions.

Permissions do not carry over to cases like you would think. There is an existing idea around this here:

https://success.salesforce.com/ideaView?id=08730000000BpYo

Currently, administrators can assign granular permissions to cases -- read, create, edit and delete. These permissions do not, however, carry over to case comments. A user with read-only access to a case can still add comments, public or private, which can trigger an email to the customer and disrupt support processes. The only way to prevent a user from adding a comment or toggling the private/public flag is to remove all access to view the case. I propose that either a) case comments inheret the permissions from cases, or b) have their own set of permissions.

The reason the comments are public are many I would think, especially when you start thinking about community, email to salesforce, channels where login not required or identification of commenter cannot be determined, etc, etc, etc. If they were limited it could break a lot of things.