why declare destructor as protected?