Read the Solidity documentation on visibility [1]. Public, private, internal, external, that really seem to mix overlapping concerns. In the visibility documentation, it explains that the default is public.
Then, in another section of the documentation, when talking about function types [2], not specifying internal or external defaults visibility to internal.
It doesn't seem like the simplest or most consistent way to express these concepts, and certainly not the safest way.