Yes, section 230 protects Facebook for public conversations. But as far as I'm aware it also protects providers of private communication, because as a user of the provider you could potentially receive illegal content from them. The provider, should they choose to moderate content by e.g. having report buttons and moderation teams, could still be treated as a publisher.