Core wordpress Sitemap exposes password protected pages

The new WordPress core sitemap seems to be exposing password protected pages, never used a sitemap plugin which was not filtering those out by default and was very surprised that the core WP sitemap does not do the same.

Is this intentional?

If yes, how can we modify the core sitemap to filter out password protected pages?

Thanks