The docs do (kind of) call this out: (my emphasis)

You can use user-defined types for parameters in your Apex REST methods. Apex REST deserializes request data into public, private, or global class member variables of the user-defined type, unless the variable is declared as static or transient.

Their example is related to deserialization, but the inverse is also true for serialization. You will need to make the private members transient if you don't want them exposed through the API.

The docs do (kind of) call this out: (my emphasis)

You can use user-defined types for parameters in your Apex REST methods. Apex REST deserializes request data into public, private, or global class member variables of the user-defined type, unless the variable is declared as static or transient.

Their example is related to deserialization, but the inverse is also true for serialization. This is implied in the docs with the line:

Apex REST uses similar serialization logic for the response. An Apex method with a non-void return type will have the return value serialized into RestResponse.responseBody.

You will need to make the private members transient if you don't want them exposed through the API.