When WSPBuilder builds the WSP package, it looks through all the classes in the assembly. If it sees any class that inherits from WebControl (and perhaps also Control/UserControl?), it will automatically instruct the manifest to add the assembly to the SafeControl list in the target web app’s web.config. This means when this WSP is deployed, you can go ahead and use these controls in SharePoint without having to manual edit the web.config.

Today I found that WSPBuilder will only do this if the class is public. If you don’t specify anything then, in C#, the visibility is internal and it will not be picked up by WSPBuilder.