The error
x may expose internal representation by storing an externally mutable object into y
complains even if y is a public field. The field being public flags it as not being sensitive internal representation and, in any case, the object stored in the field can be changed by just dereferencing the field.
So this error should not be reported against a public field.
Sounds reasonable.
Fixed:
https://github.com/findbugsproject/findbugs/commit/dfd7fdafb98b7284f2756ddfea7a750ea6da43e8