I just updated to 1.09 and the homepage/main blog in a multisite setup is public even though it is set to private with the plugin. It worked with 1.08 properly and was only after I updated that the frontpage was open to the public. I tried resetting privacy options with no luck for the main blog. With the 1.09 plugin I also cannot login via the homepage. It wants to go to http://sitedomain.com/wp-login.php and if I change the url in the browser to http://sitedomain.com/wp-admin/ it will allow me to login. Not sure why.
Basically whatever was changed between 1.08 and 1.09 broke the login and ability to make the main blog private for my subdirectory setup.
WP 3.3.1 multisite with Sub-Directories NOT subdomains.