I would actually expect both scenarios to "fail" because .find() and createComponent() should both yield a SecureComponentRef and not a SecureComponent. Component.find()'s behavior is the expected/working as designed one and we will closing the createComponent() hole soon.

A component is meant to be an encapsulated unit and the supported public API it exposes consists of its attributes, methods, and events - not its internal DOM structure. Lightning Components are secure/encapsulated by default. The internals of c:LSTestChild are its private parts in unless it explicitly chooses to expose them.

The gist is excellent - thank you!

I would actually expect both scenarios to "fail" because Component.find() and $A.createComponent() should both yield a SecureComponentRef and not a SecureComponent. Component.find()'s behavior is the expected/working as designed one and we will closing the createComponent() hole soon.

A component is meant to be an encapsulated unit and the supported public API it exposes consists of its attributes, methods, and events - not its internal DOM structure. Lightning Components are secure/encapsulated by default. The internals of c:LSTestChild are its private parts in unless it explicitly chooses to expose them.