the counter's value isn't leaking out, you're explicitly returning it. that's the point – the only thing you can "get out of" a closure is what it returns when you call it

(see also: the JS pattern of using closures to create objects with truly private "fields")