The reason for this is that any badges that reference posts run their queries against the badge_posts table. That table only includes posts that are in categories that are accessible to all users.
Yeah, I can see how that would be a problem. A possible workaround would be to rewrite the badge queries for your site to use the posts table instead of the badge_posts table. This would cause an issue for users who do not have access to your site’s protected categories if they attempted to view the posts that are associated with your user’s badges, but it sounds like this wouldn’t affect many users on your site. Possibly there are other ways this could be dealt with.