If you publish a normal function, you give a one-sided contract:  
*What does the function do if called?*

If you publish a callback, you also give a one-sided contract:  
*When and how will it be called?*

And if you publish an overridable function, it's both at once, so you give a two-sided contract:  
*When will it be called, and what must it do if called?*

Even if your users aren't abusing your API (by breaking *their* part of the contract, which might be prohibitively expensive to detect), you can easily see that the latter needs far more documentation, and *everything* you document is a commitment, which limits your further choices.

An example of reneging on such a two-sided contract is the move from `show` and `hide` to `setVisible(boolean)` in [java.awt.Component](http://docs.oracle.com/javase/6/docs/api/java/awt/Component.html#setVisible%28boolean%29).