Hi, if you make your Story Map public, the Story Map Builder or My Stories | Story Maps will let you know that those private web maps, and the data they contain, will have to be shared publicly too otherwise people accessing your story won't be able to see them. So if you want anyone to be able to view your Story Map, the web map(s) it contains (and the data the maps contain) also need to be shared publicly.
Here's my understanding of this (don't treat this as official Esri policy especially in regard to sensitive or private info):
Sharing the maps publicly does expose the data in them, depending on the format it is in. If the maps contain sensitive data that can't be shared for security or compliance reasons, definitely don't share those web maps or use them in a public story map. However, for less sensitive data, making the web map public for use in a Story Map may be OK: readers won't be able to download data from your Story Map, but they could go behind the scenes and find your web map (for example by searching for it in ArcGIS Online or grabbing its ID via browser dev tools as your Story Map loads up, and then try and download the data from it, depending on the format it is in. One alternative would be to use a static screenshot of a map in a story map (by simply uploading an image you've created) so that the underlying data is not accessible at all.
See also:Trust ArcGIS | ArcGIS
Rupert
