Jira Sub-Tasks inherit the 'Security' setting of the parent and there's no way to change it afterwards. This is by design and there's a request for Atlassian to change that

QE uses sub-tasks to track our internal work and for Stories that don't have it set, the sub-task becomes "publicly" visible. This is not desired.