The rules for auto
are, for the most part, the same as for template type deduction. The example posted works for the same reason you can pass objects of private types to template functions:
template <typename T>
void fun(T t) {}
int main() {
Foo f;
fun(f.Baz()); // ok
}
And why can we pass objects of private types to template functions, you ask? Because only the name of the type is inaccessible. The type itself is still usable, which is why you can return it to client code at all.