@dalias fair. Sometimes it can be difficult to predict which interfaces wind up being external, of course. For instance, if one component can be tricked into skipping a validation layer and handing a block of code to a more internal component, any issues in that internal component could be accessible.
Really though, what we're getting at is that distinguishing internal from external can be hard and takes a judgement call.