Unless the private subnet is airgapped from the Internet, it's not a good enough separation. Hell, even if it is airgapped, it can still be compromised by viru

Unless the private subnet is airgapped from the Internet, it's not a good enough separation. Hell, even if it is airgapped, it can still be compromised by viruses on USB sticks and such. You should never be leaving sensitive systems wide open, period, regardless of how secure you might think that network is. Thousands of data breaches have been caused because networks didn't end up being as secure or as separated as hoped for.