question_attempt is a completely encapsulated class (all fields protected, with getters where needed), except for $timemodified, which is public. (Before MDL-65245 it was undeclared, meaning that it was effectively public, and it seems that the privacy code is relying on that.)

This field should be changed to be protected like everything else.