The reason is because Google wants the user to cache the image, but not intermediate shared caches (hence the private directive).
Many intermediate cache systems may be deprecated and ignore new HTTP features (such as the cache control header), so this approach forces them not to cache the resource (via the expires header). For other agents that understand both, cache management overrides end with a header.
This is a common practice mentioned in rfc2616 sec14.9.3
The origin server may wish to use a relatively new HTTP cache management function, such as the "private" directive, on the network, including older caches that do not understand this function. The origin server will need to combine the new function with the Expires field whose value is less than or equal to the Date value. This will prevent incorrect caching of responses to older caches.
source share