In this case, how would Microsoft guarantee that the internal usages of the SyntaxList constructor do not pass null?
Presumably because they have tests which mean they're confident in their own code. If you validate all of your input, and you have confidence that your own code is correct, then you can be confident that your calls to your internal APIs have valid input.
Of course it's possible that there's a bug in the implementation, and that it would either generate or allow the pass-through of invalid input to some internal method. If you want to put more validation on internal calls, that's fine. But it's at the public API level that validation is most essential.