We have the same issue on our cloud, however we are not using the 'Free' plan, we migrated to a Jira Service Desk - Standard Plan.
Any service desks create (even if set to 'private' at creation time - add all existing customers to it - which obviously means they can see the new desk. We have to manually change the permission in the newly created desk.
Phil Watson