This is pretty much true for many languages; runtimes offering reflection usually make even private members available. OO protection is not a security feature.