If they're not supposed to be used, why can they be used? Hyrum's law strikes again!
With a sufficient number of users of an API, it does not matter what you promise in the contract: all observable behaviors of your system will be depended on by somebody. (https://www.hyrumslaw.com/)
Given enough motivation, access control is irrelevant too. See early Windows "private" API that was used for decades and Microsoft supported despite being "private", because they knew it was being used and they (used to) care about their users.
With a sufficient number of users of an API, it does not matter what you promise in the contract: all observable behaviors of your system will be depended on by somebody. (https://www.hyrumslaw.com/)