Why is this happening ?

Most likely your EC2 instances in the private subnets can't talk to the ECS control plane

If this is the case then why do they allow selecting only the private subnets to launch the instances in when they only work in public subnets?

Best practice suggests deploying your EC2 instances in private subnets. You just need to make sure they have a route to the ECS control plane.

If i want the instances to run in private subnets, then will NAT gateway work ?

Yes, if you're happy with your traffic traversing the public internet, and assuming that security groups and NACLs allow the traffic, this will work. Alternatively deploy VPC endpoints.

Is there a way to debug why an instance failed to register with ECS ?

VPC flow logs should show either traffic getting blocked by security groups or NACLs, and should show accepted outbound traffic with no corresponding inbound if the SGs and NACLs allow traffic but there's just no route. I'd expect ECS agent logs to also show errors.