Changed: a team admin can make a shared mailbox private to one member, but only that member can share it again or hand it to someone else. An admin cannot open up someone else's private mailbox. If the member leaves the team, a team admin can give the mailbox to another member or share it.
The member a mailbox is private to can change who opens it even when they are not an admin.