Hi – great question!
You could listen out for the creation of events (or even for them being updated) by using WordPress’s save_post_{post_type} hook, in this case that would look like:
save_post_tribe_events
From there you would need some logic to test and see if the user’s intent was to make it private or not – possibly by inspecting the $_POST superglobal (you may also want to add some other safety checks into the mix) and then update the post status accordingly.
It’s a bit beyond the scope of support here on the forum to go much further with a customization like this one but hopefully that outlines the basic mechanics – from here we’ll need to leave the rest to you 🙂