> `foo.__a` accessible only inside `Foo`

It's not all that inaccessible. Try:

    class C:
      def __init__(self):
        self.__private = 'Is it private?'
    
    c = C()
    c._C__private

Double underscore names aren't so much about access control (because access control isn't strongly enforced) as about limiting name collisions (by including the class name in the underlying field name).

Specifically, it's about avoiding collision of "private" names via inheritance.