Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
If a user has 'administer content types' permission, but not access to a particular private field, then they can edit that field but not its privacy settings.
They also can't set the default value, which is presumably desired behaviour.
However, they see the "The default value for this field, used when creating new content" UI help text in a blank fieldset.