Is it 'ok' to have electrostatic sensitive components on an end-user, exposed PCB design?
There will always be a certain ESD level which can damage your product. The question is, how much protection do you need so that it is "good enough" ?

For (portable) consumer products the sensitive points are all the conductive / metal contacts which are exposed. So for a mobile phone, you would use TVS diodes or such to implement extra protection on the charging port and headphone socket for example. That is not to say that there would be no protection without these extra diodes ! There is always ESD protection in any modern IC but it will be a lower level protection, it can handle ESD but not too much. For example: 500 V HBM (Human Body Model).

This level of protection (500 V HBM for example) would be enough for handling that crystal oscillator you ordered in a somewhat ESD safe environment. With this I mean, precautions have been taken to keep ESD pulses at a low level. For example: a conductive and grounded ESD mat and the user grounded by wearing an ESD wrist band.

Don't draw too much of a conclusion about ESD sensitivity by looking at the packaging or warnings companies like mouser use. If you would order resistors I bet they would also come in ESD safe packaging and might also come with a warning although resistors are not ESD sensitive.

Regarding your PCB, since it is not a consumer product and you can expect the user to know that (s)he should not be poking his/her finger everywhere and generate ESD discharges. In my experience the build-in ESD protection of most ICs is sufficient and will provide enough protection for normal usage by a user who is aware of ESD.

So if you have external connections on your board: use extra protection.

For the part that the user should not touch anyway: no extra protection needed.