I wrote a plugin a long time ago that adds a checkbox labelled ‘Private?’ to the attachment details form. When checked, it would then set the post_status of that attachment to ‘private’ via the attachment_fields_to_save hook.