> IMO there's a difference between "use at your own risk" and "this is actually not meant to be called from the outside and if it is it will violate some invariant in the code". Those are two different concepts and it makes sense to distinguish them.

That's what double underscores are for:

  $ python3
  Python 3.5.2 (default, Nov 23 2017, 16:37:01) 
  [GCC 5.4.0 20160609] on linux
  Type "help", "copyright", "credits" or "license" for more information.
  >>> class Foo:
  ...     def foo(self):
  ...         print("I'm a public method.")
  ...     def _foo(self):
  ...         print("I'm a private method.")
  ...     def __foo(self):
  ...         print("I'm so private that you have to really know what you're doing to even call me.")
  ... 
  >>> foo = Foo()
  >>> foo.foo()
  I'm a public method.
  >>> foo._foo()
  I'm a private method.
  >>> foo.__foo()
  Traceback (most recent call last):
    File "<stdin>", line 1, in <module>
  AttributeError: 'Foo' object has no attribute '__foo'
  >>> foo._Foo__foo()
  I'm so private that you have to really know what you're doing to even call me.
  >>> 

Now in theory it's not quite what you're talking about because it does rely on coder discipline to some extent, but in practice I've never seen it become an issue (although arguably that could be because not many people know that you can access double underscore variable from outside a class).