First, I need to make sure you realize that the constructor parameter 'h' in BoxWeight and the member variable 'h' are completely unrelated.
So, anyway, "private" doesn't mean that the outside world can have no effect on a variable. It just means that no outside code can write
Box b = ... b.h = 37;
No code not in the "Box" class can explicitly mention 'h'. But if Box provides a public method or constructor that itself changes or reads 'h', then any code outside of Box can call that method, and so indirectly access h. The idea is that because 'h'is private, Box has complete control over what happens to 'h'.