Currently, published orbs are world-readable as long as they are referenced by the correct name. We do not support private orbs at this moment but you are most welcome to provide your feedback on this on our Ideas Portal.
While private orbs are not supported at this time, orb publishers can unlist their orbs from Orb Registry search results by using our CLI (See the documentation of the relevant command here: https://circleci-public.github.io/circleci-cli/circleci_orb_unlist.html). Unlisted orbs can be listed in the orb registry again with the same CLI command. Only org admins can unlist/list orbs. Note that unlisting an orb does not affect its ability to be referenced by name in builds or for its source to be viewed.