I would guess it's based on the fact that when most people hear "access control" they think of "access control lists", but it's possible to do decentralized access control. That's what ocaps are.
ActivityPub can be private in the same way email is private. All the people in the recipients chain will have a copy of the object you're sending. If in these recipients there's the Public namespace, then yes, you can't talk about "private" any more, but outside of that ActivityPub supports private interactions.
As a followup on this discussion, I actually spent half a day today to add private messaging to my ActivityPub service. It actually works.
What do you base your statement on? I've heard this take before, but I haven't seen anyone provide a good explanation for it.