Company policy requires me to assume that there is another vulnerability that allows an attacker to run method A. It might exist elsewhere in my code or another third-party library that I ship, or it might exist in another application installed on the customer's server that I know nothing about. I could summarise the policy as, "The customer probably will get hacked at some point, but if they do, it won't be because we thought it couldn't happen."
Most of my development is in Java, which doesn't have static linking. If you write public methods A, B and C in a public class D, then compile D into a jar file, then the jar will contain A, B and C. The compiler has no way to know which methods will be called at run time. There are third-party tools that claim to be able to remove unused code, but it seems unwise to use them. Java frameworks use a lot of reflection, and with that in play, there's no foolproof way for static analysis to determine that a class or method will never be used at run time. So you have to monitor the application as it runs, and hope that your integration tests are good enough to make sure that all the code that's really needed runs at least once.
Or just upgrade the vulnerable library, and go back to doing work that customers are happy to pay for.