I know places that have been doing it for years. They just tell you to stop. It's basically an arms race of them trying to figure out how you're doing it and figuring out ways to prevent them from detecting it. The app has a few million users so not sure if Average Joe would just get hellbanned.
Private APIs are APIs that only Apple is allowed to use. They let you do stuff you're not supposed to be able to do like put stuff on the home screen, however, these days, it's mostly enforced by the security model, so you can call the private API all you want and it's not going to do anything.
They also let you do things like record what other apps, etc are doing. Think of the Linux top command, on iOS there's no real reason for an app to need to list the other processes, so you can't. However, if you want to know what apps are running on the phone this would be a very useful API to have access to.
They are functions (in the programming sense) that can be called by other code, but Apple reserves them for their own use. They don't necessarily have anything to do with privacy, though some of them do. The "private" refers to them not being publicly documented and not provided for developer use. Internal developers at Apple are allowed to use them, but only as appropriate. Consider a function (API) that allows one to wipe the phone. Apple doesn't want just anyone to be able to write an app that provides that feature. Same with a lot of other functionality. Other private APIs are things that Apple might someday offer to developers, but hasn't yet. For example, Apple can change the icon of its own apps (note the calendar app, which shows the current numeric month day, and the clock app, which shows the time including moving second hand) but it does not offer this functionality to developers. [Edit: I was wrong about this; see firloop's comment below.] If they did, the results could be off the rails, visually, and make the platform look bad, so I expect when they do allow this, they'll do it with a heavy review process in place... but that's just one small example. A lot of private APIs are more under the hood housekeeping stuff that you just don't want the average programmer to mess with.
However, it's much more restricted than the functionality natch referred to. An app can only change its icon while running, and even then only with the user's explicit permission.
