That means, you give up encapsulation. If you allow private methods to be called, they aren't private

The first claim is non sequitur. The second depends on a specific connotation of "private" that does not necessarily hold. Further, the concept of "allowing" methods to be called implies some way to prevent it, which is decidedly non-Perlish.

Moving onward, you can troll through the namespace of a module to see what CODE references you can find in the name space. That then gives you names of subroutines. If you want to actively prevent methods from being called under certain circumstances, you can use caller() to try to decide if the caller is acceptable, and barf otherwise. In general, that is a lot of work for little to no gain. Further, that sort of "protection" can still be circumvented by clever hackery -- hackery that has no place in a "finished" product, but possible hackery nonetheless.