The bad example in G-7230 uses constants. In this context it is fine to make them private. However there are other constants should be public. Here an example from my related blog post:

CREATE OR REPLACE PACKAGE const_boolean AUTHID DEFINER IS
   co_true  CONSTANT INTEGER := 1;
   co_false CONSTANT INTEGER := 0;
END const_boolean;
/

The guideline should be changed to make clear that this is good.

Furthermore the PL/SQL cop validator should be amended to ignore constant declarations in package specifications.