--extra-index-url does not mean fall back to. pip queries every configured index for a name and picks the best candidate across all of them by version, not by index priority. There is no ordering guarantee and no way to say this package comes from that index.
That is the dependency-confusion vector: publishing internal-billing 99.0.0 to public PyPI beats your private internal-billing 1.4.2, and pip installs the public one without warning. Confirm which index a resolution came from by running pip install --dry-run --report - and reading the download_info.url for each entry.
Two mitigations exist. Use --index-url to point at a single proxy index that mirrors public PyPI and your private packages, so there is one namespace under your control. Or restrict scope with a per-index constraint: pip 24.2 and later understand --index-url with an index that implements PEP 708 repository tracks, and hash pinning with --require-hashes makes an unexpected substitution fail loudly. Whatever you choose, do not leave the public and private indexes both listed as equals.