It's currently possible to add an unlisted repo to a public/listed hub, thereby effectively "listing" the repo since it is associated/shown by the public hub.

Even though you could argue this is a "user error" for doing the association in the first place, a warning would be nice... e.g. "you are about to add an unlisted repo to a public hub... is this ok?"