Spring dependency injection with @Autowired annotation without setter

You don't need a setter with the @Autowired, the value is set by reflection.

Check this post for complete explanation How does Spring @Autowired work

No, if Java security policy allows Spring to change the access rights for the package protected field a setter is not required.