Question: When I launch a server with a security group that allows all traffic into my private subnet, it displays a warning that it may be open to the world. 

If it is a private subnet, how can that be?

Answer: 
The main difference is the route for 0.0.0.0/0 in the associated route table.

A private subnet sets that route to a NAT gateway/instance. Private subnet instances only need a private ip and internet traffic is routed through the NAT in the public subnet. You could also have no route to 0.0.0.0/0 to make it a truly **private** subnet with no internet access in or out.

A public subnet routes 0.0.0.0/0 through an Internet Gateway (igw). Instances in a public subnet require public IPs to talk to the internet.

The warning appears even for private subnets, but the instance is only accessible inside your vpc.
As documented [here](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html)

**PUBLIC SUBNET** If a subnet's traffic is routed to an internet gateway, the subnet is known as a public subnet. 
**PRIVATE SUBNET**If a subnet doesn't have a route to the internet gateway, the subnet is known as a private subnet.