Yes, you are right about modules and internal access but it makes sense to define access level as restricted as possible