On reflection, I'm not sure this was helpful...
The ‘how’ is too technical for me, but I think the inline oneboxes are a newer feature than the original oneboxes, and may have inherited some of the originals behaviour. If so, there maybe some scope to amend it somehow?
Normally an in-forum onebox of a public post would show pretty much all the posts details, which would sidestep the category permissions if private topics were handled in a similar way. But an inline onebox has much less information displayed (and maybe could be reduced to just the topic title in these cases). That would make both public and private links behave in a similar way, without revealing much more than the raw link would.
At the moment these are how a private topic can be displayed in a separate public topic (this example is a private message, but posts from restricted categories look the same):
In the middle of a sentence, https://meta.discourse.org/t/test-message-for-oneboxing/213633/2?u=jammydodger, for inline.
On a line of its own for the original onebox:
https://meta.discourse.org/t/test-message-for-oneboxing/213633/2?u=jammydodger
And quoted:
There does seem a bit of leeway to tweak them to be prettier without wrecking the category restriction/data leak protection. But I have no idea how one would go about it. 