SSH to a node in private subnet. Any other way except having a bastion? (for windows especially)

I created a VPC with private and public subnets on AWS. After trying quite a few times, the only way I could SSH onto the private machine was via a node on the public subnet (and using ssh -A). Now, my doubt is: is there no other way of ssh-ing onto the private node? Isn't it public to the creators of the node?

I am unable to wrap my head around why even the people who created that node in the private subnet cannot log into it (unless, I can and I don't know yet)?

And if it's true that the only way to ssh into it is via the bastion node, then, how do I RDP onto a Windows machine on the private subnet? Is the only way to do it is have a windows machine on the public subnet and use that to RDP onto the private one?

Thanks!