Saving file upload destination as private
The upload destination is not saved with the field instance, but with the field base. I was using an existing file field that was public. I needed to create a new field and define it as private and save that field base in my feature.