When you start a coroutine by providing the method name as a string, then the Unity engine uses reflection to find the method at runtime, which doesn't care about the visibility of methods. This is not unusual for Unity. You might have noticed that methods like Start and Update are declared private, yet the Unity engine invokes them from outside the class.
If you would prefer proper software engineering principles - like names being resolved at compile-time and visibility rules being respected - use the variant of StartCoroutine which takes an IEnumerator instead of a string to denote the method.
WinDialogue dialogue = _winDialogue.GetComponent<WinDialogue>() dialogue.StartCoroutine(dialogue.ActivateStars(starCount)); This will give you a compile-time error if WinDialogue.ActivateStars is private (or does not return an IEnumerator... or gets called with the wrong arguments... or is misspelled...).