is_protected only protects writes - reading is always allowed

[p-blomberg]

For example, in a user class, I want to keep the password property private (not read-only) because all password validations should be done within the user class.

Also, the is_protected function is not documented.