The purpose of the USB frequency specification is this:
If actual frequency of controllers at both ends of the USB cable are within the USB tolerance specification, USB should be OK.
However...
If the frequency tolerance specification of the crystal or resonator in the controller at one end of the USB cable is looser than the USB specification, the actual frequency very well may be within spec.
And...
Even if the actual frequency is (slightly) out of tolerance, it still might work.
Note that directly measuring the in-circuit operating frequency of a crystal or resonator with a 'scope or a counter requires an extremely low-capacitance test probe (kind of expensive), not the one that I would expect to come with a general-purpose instrument.
Bottom line:
I hate to repeat myself, but we have no way of knowing what is the specification (let alone the actual operating frequency) of the resonator or crystal installed on boards that we buy. If it works, it works.
Regards,
Dave
Footnote:
If I were designing a USB circuit with an ATmega8U interface I would probably specify a crystal. That doesn't mean that a UNO that you buy is automatically defective just because it has a resonator.
I mean, if it is for a few circuits for my own use, the cost of a crystal versus cost of a resonator is a non-issue. I would use the low-risk approach of making sure my end of the circuit is designed within specification. If, for some reason, I absolutely had to use a resonator that was at the edge of (or beyond) the USB tolerance specification, I would have a test plan that let me verify with absolute certitude that that part of the circuit was operating properly before spending any time debugging software or other hardware issues.
On the other hand if I were going to produce large quantities of these, the risk of having a certain percentage of failures (in the Manufacturing Test Department or in the field) due to marginal circuit design would weigh very heavily on my sense of self-worth as a designer, such as it is.