Disclosure: EventBridge PM here.

Yes, you're correct. API destinations today cannot target private endpoints. Please contact us through your support/account team to discuss this request further. A common workaround today is to use a Lambda function as a VPC "proxy".