Javascript closures: Shouldn't this array not be editable via getArray?

Goal 1 is to only allow arr information to be gotten via getArray.

Goal 2 is to only allow arr information to be set via addToArray.

function TestObj(){
  var arr = [];

  this.getArray = function(){
    return arr;
  };
  this.addToArray = function(val){
    arr.push(val);
  };
}

var obj = new TestObj();

obj.addToArray('derp');
console.log(obj.getArray());

//['derp']

obj.getArray().push('aderp');

console.log(obj.getArray().length);

// 2

I'm confused. doesn't getArray return a pointer to the array stored in arr, not arr itself? This is closure 101, am I forgetting a () somewhere?