If you deliberately hand a thing out to someone, they can access it.
This is no different from the fact that you can pass e.g. a private int member as a parameter to wherever you want, even by reference so they can modify it.
In a sense, protected/private prevents theft, not gifts.