The bad example in G-7230 uses constants. In this context it is fine to make them private. However there are other constants should be public. Here an example from myrelated blog post:

CREATEOR REPLACE PACKAGE const_boolean AUTHID DEFINER IS   co_true  CONSTANTINTEGER :=1;   co_false CONSTANTINTEGER :=0;END const_boolean;/

The guideline should be changed to make clear that this is good.

Furthermore the PL/SQL cop validator should be amended to ignore constant declarations in package specifications.