Private Site + Multisite

I’m using the Members plugin on a subdirectory multisite. Let’s say I have the following subsites:

• https://example.com – Main Site
• https://example.com/site1 – First Subsite
• https://example.com/site2 – Second Subsite. Should only be accessible to logged-in users of that site

To make site2 private, I checked the “Enable Private Site” box.

My expectation is that only users who can log in to site2 would be able to see the content. This is similar to how “Private Site” works on wordpress.com – I have to be invited to that site as a user in order to see content on a private site.

However, it looks like Members behaves a little differently. All users who can log in to the main site can view site2, even if they are not users on that site.

Is that the intended behavior for Members on Multisite, or am I doing something wrong?