I understood that the post button in most Nostr clients does post it to the network. There are no tools in Nostr to limit posting to some groups. You don't select where you post to in most clients, there are preferred relays, not ultimate relays, there are no per note relay sets anywhere in the user interface. It might be used like that in the future, when it's the responsibility of relay to limit writing and reading of notes to those that should be authorized. And that means not allowing connections from relays that could copy the notes. 

I see what you are saying as a potential problem in the future, but I think encrypted messengers are much better for sharing within a closed circle. Nostr is for public sharing, it's not encrypted, notes don't have any permissions attached to them except for the - tag, which is a self limitation like robots.txt.

There's even a tool like http://nostrsync.live/ which will download all notes created by an npub from a list of a lot of relays and try to publish it everywhere. Note that authorization is not required, I can do it for your npub and the relays have no way of telling that you did not post that message to the relay, it's all valid signed notes.