Visibility is not security.

visibility.rb

class Test
  attr_reader :state

  def initialize(state)
    @state = state
  end

  private
  def update_state(state)
    @state = state
  end
end

t = Test.new(:before)

# This will raise an exception
t.update_state(:after)

# This will not
t.send(:update_state, :after)