I've used public ArcGIS Online services plenty of times in ESRI JS web apps and I imagine that using them as layers in Leaflet is pretty much the same. The one problem I can see is how would one access a private service? In the ESRI JS api provides an Identity Manager to facilitate OAuth and cookie handling. Leaflet provides no such facilities.
Has anyone done this?