I think React have the right approach. If something isn't part of the committed to public API, then it's named `__unstable_foo`. Consumers of the library are free to use them, but they can and will change at the whim of the maintainers regardless of any stability guarantees that the library usually provides.
This allows advanced consumers to tinker where they need to and are prepared to take on the maintenance while leaving potential complainers no leg to stand on if the API changes.
Can't you already hide your implementation details using a closure?
If Bar depends on a private internal of Baz, and Foo depends on Bar, then if Baz publishes a patch version that changes an internal to fix a bug, Bar breaks, and so does Foo.