Private and public are correct yes.
If a function should only be called from within the 'class' (plugin) that it is in, then it should be private.
So in the case above, we wouldn't call enableNotifications from elsewhere in the app, so it makes sense for it to be 'private'.
When you had a route to enableNotifications you were right to make it public, now that it's just an onClick event handler, there's no need for it to be public.
Does that make sense?