Private fields would absolutely make it much harder to do some of the bigger hacks that I've done in the past.
I'm afraid these also all risk major compatibility disasters and so consequently it is our intent to make them impossible if we can.
Again, I'd point out in virtually all other software on the market, encapsulation is the industry standard and such things are impossible to begin with. It's only due to historical reasons of the development of JavaScript language that there was no encapsulation in the first place. If JavaScript had private properties and methods 10 years ago, we would certainly have used them from the start, and this situation would never have happened in the first place.
For what I've seen, most of your alternatives are "don't do it".
The compatibility disasters that hacking the internal engine risks causing are so bad, that yes: "don't do it" is a better option. If it really is impossible to do what you want, you can file a feature request and move on - which is what we do ourselves with all other software when we need something more than they provide, because hacking the internals is generally impossible, because encapsulation is the industry standard.
If this increases pressure on us to improve the addon SDK, that's good - in the long term we'll get there but in a sustainable way, without risking ruining thousands of people's projects. But I also think in many cases people will also figure out other approaches that get the job done but don't need to hack the internal engine - options developers should have chosen in the first place, but ended up never trying to research them because they could just access the internal engine.