I'm not an epidemiologist, but I do a lot of computer science and at a high level, infection in computer networks and in humans have a lot in common. Ultimately both come down to two factors - transmissability and payload.
Let's discuss transmissability first. In epidemiology, there is a factor called R0, or R-nought. This was made famous in the movie Contagion, but if you check the link you get a more realistic definition of the term. Ultimately though, the higher the R value, the more infectious it is and therefore the harder it is to control. Ebola for example has an R value of around 2. Measles, depending on where you are, has an R value between 12 and up to 20.
In most of history, the really deadly diseases have not been as infectious as the ones that cause less severe symptoms. When that balance is breached, we have major 'plagues' that wipe out a lot of people and make the pages of history. This comes down to the payload. Whether it is a bacterial infection or a viral, or even fungal, if it spreads easily and has hard to treat and severe symptoms, you'll have trouble with it.
Personally, I'd go with fungal. Mushrooms and their poor cousins are scarier than you might think and these days we have antibiotics to treat most bacterial infections (although some are becoming highly resistant to our antibiotics, just look up MRSA) and we are also making good headway with anti-virals at the moment, but I haven't read a lot on good anti-fungals of late. These things can be lethal - just look at the death cap mushroom and of course the creepy Cordyceps mushroom.
The point being, that if you can get fungal spores to reach a high value through sneezing or some other form of spread by infected people and animals, then humans currently don't have a lot of defence against them, and we already know that they are capable of killing us.
So; ultimately you need to design a disease that is really infectious and hard to treat while also being fatal, preferably over a long enough period that the person can infect others, but not so long that we have time to treat them. Ideally, like many versions of the common cold, they'd remain asymptomatic (not showing any signs of having the disease) for several weeks while still being contagious, so that they are infecting many others before they manifest the symptoms that lead to them being quarantined.
A final word on antibiotics and the idea of the 'right' ones being held back by the designer of a disease - you don't have to do that. There are already some bacteria that are becoming resistant to the antibiotics we currently have, and ultimately we are in a constant arms race with bacteria, finding more effective antibiotics to kill them while they adapt to our treatments. In point of fact, our use of antibiotics is accelerating the evolution of these bacteria, only allowing the most resistant of them to survive our treatments. So, even if you are looking at a bacterium for your disease, you don't need to 'withhold' a specific antibiotic, you just need to release a disease that has become resistant to the current wave of antibiotics. It's going to take time to counteract it and by that time, you've already killed off a lot of people.