Presumably because many private APIs are used behind the scenes by public APIs and the security model must allow applications to run them.