Private data in node format
Drupal only sets node/nid as public when you give anonymous users permission to "access content". Additionally, you can use modules like http://drupal.org/project/content_access to specify what roles can access specific content types. Lastly, you can use http://drupal.org/project/field_permissions to specify what roles have access to specific fields on your nodes.

To answer your other questions, I don't think you need to write any custom modules to cover these needs and using Drupal to provide content only to privileged members is a very common use case.