The documentation says this about private and protected functions in Blueprints:
[TABLE]
Protected
A setting of Protected means that the Function can only be called by the current Blueprint, as well as any Blueprints that derive from the current Blueprint.
Private
A setting of Private means that the Function can only be called from within the current Blueprint.
In reality, it seems like these settings do nothing? Regardless of whether I set a function to private, protected, or public, it seems it can be accessed and called by any other BP, without even a warning.
Actually it looks like this issue is almost four years old: Private functions are listed in external blueprints - Blueprint - Unreal Engine Forums
Are there any plans to fix it?