WordPress secure way to have Private/Public posts

Solution:1

You dont need to use a meta field to get private posts, its available on the wp query post_status parameter.

$args = array( 'post_status' => array( 'publish' ) ); // regular users
if ( is_user_logged_in() ) {
  // signed in users
  $args['post_status'][] = 'private';
}

$query = new WP_Query( $args);

Solution:2

I believe the most appropriate in your case is to use WordPress capabilities. Editors are already able to view private posts/pages on the front-end if logged in (because they have the read_private_posts capability).

Here’s an example of how you would make private posts/pages viewable by author user role.

function so0805_init_theme_add_capabilities(){
    /* allow authors to view private posts and pages */
    $role_author = get_role('author');
    $role_author->add_cap('read_private_pages');
    $role_author->add_cap('read_private_posts');

}
add_action('init', 'so0805_init_theme_add_capabilities');

Paste this code inside functions.php of your theme.