Understand why module-pattern privacy relies on closures, not prototypes.
Consider the classic revealing module pattern:
const counter = (function () {
let count = 0;
function increment() { count++; }
function value() { return count; }
return { increment, value };
})();
What mechanism makes `count` truly private yet still readable/writable through `increment` and `value` after the IIFE has already returned?