How to have ValueTree::Listeners while protecting ValueTree data?

This is a bit of a broad question. I’ve been working on an application with JUCE and using ValueTrees to build the data model.

I try to follow good OOP principles, and keep the data sources of classes private. However, once you make a ValueTree available to ValueTree Listeners, even if the ValueTree is a private class member, then the ValueTree can be modified by those Listeners’ callback methods (e.g. valueTreePropertyChanged).

So, how do you design around this?

So far, it seems like you either give up the idea of using ValueTrees for private data, or you don’t use Listeners for them (which of course is a big part of their appeal in the first place!).

Instead of ValueTree Listeners, you could instead use ChangeBroadcaster/ChangeListener (or ActionBroadcaster/ActionListener) pairs, and have a class notify others about changes that way - then the class stays in control of the data in the ValueTree.

I’m sure others have hacked through this issue before… if anyone has recommended reading on the subject, I’m all ears.

Or to put the question more narrowly: is there a way get the advantages of using a ValueTree Listener, without the potential disadvantages of allowing the “listener” to also be a ValueTree modifier?