That's what I always thought as well.
But, a few weeks ago, I registered a new domain and applied it to a new site. I didn't give the URL to anyone or post it anywhere. But within 24 hours the site was visited by Googlebot. One day later, the site was in Google's index. And now, after three weeks, the site has received about a dozen visitors. And all this time I've been the only one who knows the URL (well, except for the hosting company and the domain registrar).
Based on this experience, I wouldn't rely on the site not showing up, just because you don't publicise the link. As Dr John rightly says, it's unlikely you'll get any significant traffic. But if you really want to hide the site, Robots.TXT is surely the way to go.