Java's `private` Isn't What You Think