The author of the article links to the official specification which was made for ActivityPub.

Yes. Search that specification for "private." You'll find precisely one reference to it, which doesn't deal in any respect with how post privacy needs to work. It just briefly mentions the concept of follower-only profiles.

I also looked over the ActivityPub spec and didn't find anything. Where are you saying it is mandated by ActivityPub that you need to treat some particular posts special?

I thought it was a fork of Mastodon where this private functionality was first implemented, because the official developers were reluctant to do it (and because often big steps forward come in the forks for whatever reason). I could be wrong about that. Regardless, my point is that they're doing something somewhat nonstandard and unsafe by federating out "private" posts in this fashion, and it's not even slightly surprising that it managed to fuck up in this particular predictable way. Pixelfed is far from the least careful or responsible of the microblogging forks out there.

Mastodon, in general, is regarded as careless with safety. There was some discussion way back when about the implications as far as federating out private content to untrusted servers and some remedies that might strike a good balance. I actually think this article summarized things extremely well:

Something you may not know about Mastodon's privacy settings is that they are recommendations, not demands. This means that it is up to each individual server whether or not it chooses to enforce them. For example, you may mark your post with unlisted, which indicates that servers shouldn't display the post on their global timelines, but servers which don't implement the unlisted privacy setting still can (and do).

Servers don't necessarily disregard Mastodon's privacy settings for malicious reasons. Mastodon's privacy settings aren't a part of the original OStatus protocol, and servers which don't run a recent version of the Mastodon software simply aren't configured to recognize them. This means that unlisted, private, or even direct posts may end up in places you didn't expect on one of these servers—like in the public timeline, or a user's reblogs.

See, that's fine as long as that's the user expectation. There are a lot of visibility settings that are kind of fine as long as a big horde of people doesn't unexpectedly show up. But if, like in the OP article, someone's posting private content and genuinely expecting it to be private, they need to be educated about how Mastodon does post privacy, before they keep doing it and keep getting shocked that it isn't private.

The article also goes into great lengths about how the security update was handled poorly, with inappropriate communication along the way. It contrasts this with a correct update.

Yes, I read it. His opinion that it was handled poorly is wrong. The "security issue" is created on Mastodon's side, and the proper remedy is for it to be widely known among the users that visibility settings are recommendations, not demands. Keeping the idea that this is happening a secret is very bad security policy. I suspect that he's having a performative freakout about the way Dansup committed the change, for whatever reason, but regardless of the motivation, this was exactly the right thing to do: Fix the issue and be open about what version has the fix. The article's demands for secrecy surrounding it, when the underlying issue in Mastodon's federation is still right there ready for any other server software to mishandle, is wrong and creating a bad privacy situation for the users.