java.lang.reflect.Field (get* and set*) and Method (invoke) base their access check on the declaring class.  This is contrary to the JLS, which defines accessibility in terms of the reference type.  Consider the following:

foo/Y.java:

package foo;

class X {
    public int i;
}

public class Y extends X {
}

bar/T.java:

package bar;

import foo.Y;

public class T {
    public static void main(String[] args) {
	Y y = new Y();
	int i = y.i;
	try {
	    y.getClass().getField("i").getInt(y);
	} catch (Exception e) {
	    e.printStackTrace();
	}
    }
}

The Field object from getField has no knowledge that it is accessed through a reference Y.i, which can refer to this field.

At runtime, a workaround is to use MethodHandles.Lookup.findXxx methods, which correctly checks against the referenced class.