Prototypical inheritance does not in itself forbid concepts such as public/private access. Protected access cannot meaningfully exist because every object delegates unhandled messages to its prototype, i.e. is an ordinary client of the prototype (aside from setting
In a pure OOP system, private visibility is not meaningful as objects are defined solely through their public interface. Anything else is an implementation detail of that object. However, this view is not very useful in practice.
You are completely right that you can use closures to have private access to data. But this is orthogonal to prototypical inheritance. While unusual, I could use similar approaches in a some class-based language like Python, though now I'd get a new class for each object (because the methods must close over different private data).