They can't be completely private because instances have to share how many upvotes each post has. That's a limitation of the fediverse, since everything is spread across many independent systems, data has to be exchanged across them.
As of now, they're semi-private because end users can't easily see who voted on a post/comment unless they manage an instance themselves.
Yeah, I'll be honest, never have I took a look at somebody's likes on Twitter or Mastodon.