A VPC defines an address space. Subnets divide that space and each subnet belongs to one Availability Zone. A route table selects a next hop for a destination; the most specific matching route matters. A subnet is called public when its routing supports a path to an internet gateway, but an instance also needs suitable addressing and filtering before it is reachable.
A private subnet can reach other private resources through the VPC's local route. Internet egress is a separate design choice, often using a NAT gateway or a service endpoint. Do not attach a public label to a subnet and assume the network changed. Inspect the associated route table and its actual entries. The missing-default-route task is a common example: the gateway can exist while traffic still has no route to it.