I've been reading about private/public/protected classes in php5. By protecting a particular function inside a class with private, outside access to this function will no longer be available. My question is; is it simply an extra layer of security?

Security? Not in the traditional sense of security against malicious hackers.

Private/protected does ensure that the particular method or attribute cannot be used outside the class/child classes and it can help make sure that it is only called by your code or by code that extends your code.

For example (don't know how appropriate), since we want the vars on a XoopsObject to go through setVar() or getVar(), we could make the $vars attribute private in the XoopsObject class. Anyone wanting to change or retrieve an attribute will have to go through setVar() and getVar() and we should be safe from rogue code modifying attributes directly (and potentially incorrectly). Of course, this particular "problem" can also be solved with __get() and __set() methods.