The private parts need USB definitions (and are thus preferably used from USB_H_USER_IS_RIOT_INTERNAL compilation units). Functions like usb_board_reset_in_bootloader do not depend on USB headers for their definitions and are fair game throughout the application even for generic RIOT USB devices.