It could be privately owned, but it doesn't have to be. As long as the peg can be enforced trustlessly with smart contracts, there need not be counterparty risk. Until of course, we get to how to secure the sidechain. Merged mining has been floated as an interesting way to avoid consensus being federated among "owners" of the sidechain, which is the privately-owned model you're suggesting.

And the private and/or federated model can work too -- I think that's the proposal for Liquid -- but it doesn't need to be private. At least in theory.