2
Security? Not in the traditional sense of security against malicious hackers.
Private/protected does ensure that the particular method or attribute cannot be used outside the class/child classes and it can help make sure that it is only called by your code or by code that extends your code.
For example (don't know how appropriate), since we want the vars on a XoopsObject to go through setVar() or getVar(), we could make the $vars attribute private in the XoopsObject class. Anyone wanting to change or retrieve an attribute will have to go through setVar() and getVar() and we should be safe from rogue code modifying attributes directly (and potentially incorrectly). Of course, this particular "problem" can also be solved with __get() and __set() methods.
"When you can flatten entire cities at a whim, a tendency towards quiet reflection and seeing-things-from-the-other-fellow's-point-of-view is seldom necessary."
Cusix Software