A private subnet has no internet gateway route but reaches the internet through a centralized transit egress VPC. Why is the label private insufficient for a compliance conclusion?

1. Every subnet without a local internet gateway is mathematically unable to send any internet traffic.
2. Effective exposure depends on the complete routed path and controls, including transit and central egress.
3. VPC Name tags automatically block all public destinations.
4. A Transit Gateway always encrypts and denies every public destination by default.