Consider making attributes hidden or visible with methods.
This would be an options to temporarily "disable" access to attributes and relations. Meaning when one has hidden an attribute it will not return the value when using getAttribute.

This could also hide the attribute when looping over the model woth for...of (can be achieved by setting enumerable: false.

The proposed api would look like:

user.makeHidden(key).makeVisible(key);

Questions:

• What should happen when one tries to use setAttributes
• What should happen when sending data to the api (I imagine it should still be there)