In AccessControl and AccessControlUpgradeable _grantRole is internal
This practically makes _setupRole redundant, since _setupRole just calls _grantRole, and both have the same visibility level.
The only advantage _setupRole have is that its name implies that it doesn't perform any checks before assigning the role, hence good for initialization.
So, I believe that making _grantRole private will add security.