Until recently, private accounts on Instagram were leaving certain photos accessible to anyone with the right link, according to a Quartz investigation. The bug, which was closed as a result of Quartz's work, meant that photos posted to a public Instagram account would remain available even after the account was made private. That doesn't explicitly contradict anything in Instagram's documentation, but it's still a potentially nasty surprise to anyone who's made their account private to fend off unwanted visitors. As long as you had the public link to the photo in question, the link would have continue to work indefinitely.
In part, the privacy hole is a result of Instagram's tricky sharing settings. Many services like Twitter don't allow for embedded Instagrams, so sharing a public link is often the only way for users to view a photo from another platform. Even private users will often have to make individual photos public if they want the photo to be shared on other services. Still, the update is a welcome fix, given the growing problem of harassment campaigns on social media. Letting users take their photos private — and making sure they stay private — is often the best defense.