Yes, this is typically how moderation works on any platform. Unless it is encrypted it's not "private".

If it's a truly private video, it should be only visible by moderation when logged in as a moderator.

If it was an unlisted video, the moderator would just need to know the reference code (URL) for the video, and could share it with anyone.

As mentioned in the article, the original leak was a screenshot from admin.youtube.com

No, it's not. Typically moderators can view content that needs moderation, i.e. is visible to other users. There is no reason to give them access to all private videos, which are different from unlisted.

Yes it is. You can keep saying "no it's not" until the cows come home, but every single bit of unencrypted content (and possibly well known hashes of encrypted content) is subject to moderation on any large corporate property.

If you have confidential data don't upload it to Youtube, or really anybody else's servers.

They can view videos they are assigned to review, but they can't just pull up a random private video.