[deepsun]

Spring, Guice? They need to instantiate classes, and call factory methods.

[vips7L]

Yes and they do that by calling the public constructors, which is permitted by the module system because they are public. There is no cracking into private methods there.