It doesn't really matter if you use a private, protected or a public method. When your class is compiled into a servlet and it works is't ok. The visibility of methods inside a servlet does not compromise the security of your web application. On youre local machine you could only use the method and call them if you use the compiled classes directly and since they are compiled the name of that class if hard to find because it depends on the JSP engine that is used.
But if it is common practice? I do not know. As I explained above; if it works then it doesn't really matter.
A purist would say that it would have to be private, since the method is only being used by this specific JSP.