Can a web app shared publicly contain layers that are not shared with everyone?

No. When a web app has one or more layers that are not shared with everyone, the entire web app cannot be viewed publicly and requires viewers to sign in to ArcGIS Online before being able to view the web app.

In cases where a web app must be published for public use, but has some layers that require constant updating, a hosted feature layer view can be created for the hosted feature layer used to create the web app. Refer to: ArcGIS Online: Create a hosted feature layer view