In AccessControl and AccessControlUpgradeable _grantRole is internal
This practically makes _setupRole redundant, since _setupRole just calls _grantRole, and both have the same visibility level.
The only advantage _setupRole have is that its name implies that it doesn't perform any checks before assigning the role, hence good for initialization.
So, I believe that making _grantRole private will add security.
_setupRole was deprecated in favor of
_grantRole and it will be removed in a future version.
Ahh, I didn't notice that, thank you for your response!