"Private networking" as defined by assigning private-range IP addresses are only private as long as there is no route to your network, or as long as it's isolat

"Private networking" as defined by assigning private-range IP addresses are only private as long as there is no route to your network, or as long as it's isolated on a dedicated vlan (even then, there could be some rogue machines). In the first case, you need a firewall for IPv4 anyway. In the second case, that would also work with IPv6. Disclaimer: I know nothing about Azure/AWS internals.