Facebook is quite literally the WORST possible social platform to do anything you're trying to keep "secret". The group system is a sick joke, that has been controversial ever since they introduced a couple years ago. You have abosolutely no control over what groups you get added to, because anyone who is in your friends list can chose to add you to a group without your permission. Not "invite" you, ADD you so that you are a full member of that group. And even if the group is private, the fact you're now a member of that group will show up in your timeline, unless you've specifically locked down your timeline and profile so no one - not even friends - can see anything.
Also, Facebook has a long history of randomly changing privacy settings and outing things that you had previously put private. They want everything you post to be public, because it increases search hits and makes it more valuable to advertisers. This is why they deliberately make privacy settings convoluted and confusing. Facebook is not concerned about your privacy, at all. It's literally contrary to their revenue goals.
The rule of thumb is this: ANYTHING you post on Facebook should be considered public, even if you think you've locked it down. But unfortunately, people just don't understand this and will continue to get embarrassed by Facebook.