We should allow injection into private and protected fields and properties (for both APIs). I personally wouldn't like to make something public just because the framework needs to inject something into it. Again something we can add later if not currently supported.