I am not trying to defend the approach Epic has chosen as it is confusing but I can see where they are coming from.
Making things private rarely has anything to do with security but rather you are showing what the variable is intended for and more importantly not intended for.
Blueprint is often more open in regards to access while C++ keep access as limited as possible to guide the reader in the right direction without having to dive into the implementation.
You could make everything protected or public but now you are pushing responsibility beyond the base class.