Addressing review feedback: this avoids calling shared_from_this() from
outside the implementation. Note: it is not possible to use private
inheritance of enable_shared_from_this to prevent this issue in general,
because enabled_shared_from_this relies on the shared_ptr constructor
being able to detect that the type has this inheritance, which means it
must be public.