I personally don't want yet another level of access control. I think a better long-term solution would be to allow test code to be written in the same module/file as the code it is testing, so it could use the same access control rules as the rest of the language. This avoids having to design various ways to poke holes in the access control model for testing purposes and could allow @testable to be eventually deprecated. This has been discussed a few times here, but I don't have any links immediately to hand.
Edit: Here's one and another.