A getter that breaks encapsulation
```java class Student { private List<String> courses = new ArrayList<>(); public List<String> getCourses() { return courses; } }
Student s = new Student(); s.getCourses().add("hacked"); ```
The field is private and there is no setter. Why did that work?