Yes, you are absolutely right. The security of a distributed system heavily depends on the amount of nodes that check and confirm a state update. If only very few nodes have the entire state stored and are able to confirm updates, it is very easy to disturb the network.
That`s why the scaling problem is so difficult: We need to push more transactions through, but we can not put too much load on individual nodes or they will go offline and the network will get more and more insecure.
But back to your question: Private blockchains don't necessarily have to be distributed. If a company with 20 branches and 500 employees want's to implement blockchain technology to track parcels in warehouses, they might be well served with one full node per building and 500 light clients in handheld devices. In this case, the blockchain is not distributed but decentralized, that would already be a great step forward in comparison to the old centralized system this fictional company was using.