Likely not practically relevant and only a small nit, but I would think that it would make sense to just not distinguish between "even more internal" or so variables and just also make _debug protected, maybe someone wants to customize the devp2p package and add own debug messages, whatever.

I was on the fence about this one, but since debuggers are usually initialized specific to a class, I opted for private.

The protected version is also remaining in the class scope, so this is just a bit broader so that people can e.g. subclass the Server class, e.g. for a custom binance devp2p implementation (super random example) or whatever. And then on the subclass one might want to adjust some properties and it is just a bit unlucky if these are then not accessible. So at some point in time [tm] we generally decided to favor protected over private, since it (more or less) achieves the same thing and has fewer side effects.