I think if you password protect a game, the game should only be accessible to others through an invite or if they have the password. I have more private games ruined by friends or friends of friends jumping in than I get to enjoy. You get a good group going where everyone is on the same strategy page and everyone knows how to play to minimize chance of dying, then a button masher or an archer or mage who plays like a warrior trying to tank large groups shows up and carelessly runs around activating every creature in the vicinity making avoiding dying nearly impossible.

These incidents are usually followed by everyone in the group worth playing with leaving the game. It's frustrating. And you can boot people, sure, but it's hard to do it when you're fighting and often leads to dying while you're in the boot screen, let alone the drama messages of "why'd you boot me man?" and the conversations that follow. It'd just be easier and a lot less frustrating if I didn't have to deal with the problem in the first place.