Working on escalation functionality, I learned there really isn’t privacy with Internal Only messages either (beyond escalation messages). If an escalatee is specified on a case and an Internal Only message is then entered for that case (in the Reply field, of course) and then the escalatee responds to the email they received as part of the update to that case when that Internal Only message is entered, the customer will receive the escalatee's response.

Make sense what’s happening there? I don't see there's any way to have private internal, 2-way communication in cases. Is there?

I’d say a pretty high priority enhancement request is to make sure messages marked Internal Only can never make their way to customers; along with that, escalation messages should be considered internal only or, better yet, have the option to be marked internal only or not.