From the Google Maps premier FAQ:
The KmlLayer class that generates KML overlays in the Google Maps API
uses a Google hosted service to retrieve and parse KML files for
rendering. Consequently it is not possible to display KML files that
are not hosted at a URL that is available publicly accessible, or that
require authentication to access.
If you need to develop applications that use KML files hosted on
intranet sites we recommend that you either:
Use the Google Earth API which supports client side parsing and
rendering of KML.
Render the KML on the client side by using
browser, performance may be lower than by using the KmlLayer class.
This doesn't breach the same-origin policy as the files are sent to the browser from a Google server rather than the original source server of the KML URL.
You could consider making URLs that are very difficult to guess such as using a different GUID for each request. But you would still need to trust Google to securely handle your kml and keep it secret.