I think  change this would be risky and could break code that uses dir() to actually know what is in a module.

IIRC, this was discussed when __all__ was introduced. I believe it was decided that __all__ would affect from-imports and help() but not dir().  This decision has been in place for a long time now and I would expect that people (and tools) have come to rely on the current behavior.