Subcategories do not inherit permissions from parent category

This sounds related to
https://meta.discourse.org/t/unauthenticated-users-can-see-topics-in-private-categories/16577

But it looks like you are running the latest version, so it must be different somehow…