The short answer: the mount itself worked (that's why .bashrc shows up decrypted), but the kernel is silently hiding entries whose encrypted filename was created under a different filename-encryption key (FNEK) than the one used for the recovery mount. eCryptfs doesn't error on this — it just leaves those names out of the directory listing.

Why this happens

• With filename encryption, every name in .Private is stored as ECRYPTFS_FNEK_ENCRYPTED.XXX.<16-hex-fnek-sig>.... The FNEK signature is embedded in each encrypted filename, and the mount option ecryptfs_fnek_sig selects which key the kernel uses to decrypt names (Ask Ubuntu).
• If an entry's embedded sig doesn't match the mounted FNEK sig, the kernel can't parse its tag_70 packet, logs Could not find key with description: [...] in dmesg, and the entry is simply not shown (Gentoo wiki, U&L).
• ecryptfs-recover-private mounts using the sig in Private.sig (second line = FNEK). Files created in an earlier setup / during a session where a wrong or different key got loaded end up encrypted with a different FNEK — a documented Mint-user case where "some ecryptfs folders are invisible" for exactly this reason, distinguishable because the characters after ECRYPTFS_FNEK_ENCRYPTED. differ from all sibling entries (Linux Mint Forums).

How to confirm

1. On the raw data: ls /home/.ecryptfs/USER/.Private/ — compare the embedded sigs. Any name whose sig marker differs from the second line of .ecryptfs/Private.sig is the hidden one (likely your "VirtualBox VMs").
2. dmesg | grep fnek while listing the mount — you'll see ecryptfs_parse_tag_70_packet: Error attempting to find auth tok for fnek sig [...].
3. Also rule out the trivial case: /tmp/ecryptfs.* may match several mounts from repeated runs of the tool; check mount | grep ecryptfs and look inside each one (Ubuntu manpage — the tool creates a new /tmp/ecryptfs.XXXXXXXX per run).

How to read the hidden directory

Mount manually with the other FNEK sig:

ecryptfs-unwrap-passphrase /home/.ecryptfs/USER/.ecryptfs/wrapped-passphrase
#  → note the hex passphrase, then:
ecryptfs-add-passphrase --fnek   # paste it, note the second (fnek) sig
mount -t ecryptfs -o ecryptfs_sig=<fekek-sig>,ecryptfs_fnek_sig=<sig-from-the-hidden-name>,ecryptfs_cipher=aes,ecryptfs_key_bytes=16 \
    /home/.ecryptfs/USER/.Private /mnt/plain

Note the sig may differ between sig and fnek entries — the Ask Ubuntu/Gentoo pages describe exactly this procedure (Ask Ubuntu, Gentoo wiki). If only a couple of entries are affected, an easier route is to rename/move those encrypted blobs into a tree mounted with the matching key and decrypt there, as done in the Mint forum thread (Linux Mint Forums).

One more caveat worth knowing: with FNEK, plaintext names are limited to ~143 bytes (encrypted names must fit 255 bytes), but "VirtualBox VMs" is far below that, so it's not your issue here — it's a sig mismatch, not length (ArchWiki).