Defender streaming setup and integration with private event hub

Maybe I do not understand what you mean here, but we are sending XDR events to event hubs and these hubs are absolutely not public in the sense that anyone lacking correct credentials issued by our tenant can connect to them. I assume from my experience setting them up that non-public is the default.