Private function not private

I’ve got a function in a function.
The internal function [ add() ] can be invoked from outside if I first call the external function.

	function func( a1, a2 ) {
		var attrs = [];

		private Numeric function add( a1, a2 ) {
			return a1+a2;
		}

		return add(a1, a2);
	}
	
	writedump(func(2,3));
	writedump(add(1,2));
           //result: "3" with Lucee
           //result: "add() not found" with CF2018

If I comment the line:
writedump(func(2,3));
the add() function is no longer callable.

With Lucee 5, 6, 7.

Any hint?

Access modifiers like private, remote etc are only for components

Add is unscoped inside a function, so it’s being added to the calling variables scope, try dumping the variables scope out