Not to expose the jar file that I depend on

I have an AAR library that depends on a certain lib.jar. I added it in my AAR by doing:

dependencies {
    implementation files('myexternallibs/lib.jar')
    ...
}

In the resulting AAR, I can still access the classes in lib.jar. Based on many answers here in SO, the keyword implementation should keep this from happening. Anything I missed?

from Not to expose the jar file that I depend on