You're totally correct, Drupal's coding standards denote anything with a
_ prefix is seen as a pseudo-'private' function. As such the
_form_validate() function was never meant to be called directly. Unless you really need to use it, and you're absolutely positive there's no other way to accomplish what you want, I wouldn't advise using it.
In fact only one function in the whole core system calls
drupal_validate_form(). It would stand to reason that you should be using this function instead (being that it's not marked as a private function).
These are the functions that Drupal uses internally to validate a managed form, so if you're using the Form API correctly you should never need to call them. Adding validate handlers to a form to validate individual elements is the correct way to do things.
Just to clear up a wee bit of terminology as well,
hook_validate() has nothing to do with the form API as such; it's used by node-providing modules to validate nodes before saving. The validation handlers that you add to forms (with custom forms, or through
hook_form_alter(), don't have a particular 'Drupal name' that I'm aware of.
Also, you don't actually even need to use the standard named
_validate function if you don't want to...you can add a function with any name as a form validate handler:
$form['#validate'] = 'my_strangely_named_function';
Drupal just looks for
FORMNAME_validate() by default, and runs it if it exists.