At least by German law, hubmins can be held liable for what’s happening on the pubstream because it’s happening on their “website”, and so they’re responsible for it. And remember that most public Hubzilla hubs and the two biggest ones are German.
That's true. We are protected by Section 230 of the Communications Decency Act and the Digit Millennium Copyright Act (DMCA) and the common law legal concept that you cannot be held liable for someone else's actions.
Other countries may not provide the same protections.
Does it even matter if they know? The private content is supposed to be invisible to them anyway. The fact that they don't know it exists would make it more invisible.
Also, some platforms, like Mastodon, have actually adopted some privacy. For example, they added "followers only" posts that only their followers can see. If they are aware of Mastodon's "followers only" posts, then they already understand the basic concept of limited distribution.