its not just at the room level, its at the org level.
the standard practice is that people create rooms in a slack org - and they are guaranteed that they are private to the org. one more step is where i can create private rooms to a few people within the org.
XMPP obviously can support this, but the products built on top of XMPP are too open. The protocol doesnt have an issue - but the people building products on top of XMPP have an inherent distaste for organizational workflows.
I intend to release that soon to https://inverse.chat.
Rooms can be made private, members-only and non-searchable. This is standard XMPP behavior.