But when I read the decompiled code, I find that the private qualification of object is gone. How to understand this?

In java you have: private constructor of class and private member. So incapsulation is not broken.

You can't have a private top-level class in Java. See the docs on Java interop https://kotlinlang.org/docs/reference/java-to-kotlin-interop.html#visibility

private top-level declarations are compiled to package-local declarations

I found a bigger problem. In the above figure, the database instance built in the Lazy proxy is used, and the migrate set in this way will be optimized by the compiler directly, but no error will be reported.