The package is disclosable to any user enrolled in the course containing the AICC/SCORM activity: it should be just available to whom is charged to manage it.
Due to the nature of 1.9 framework the fix must be coded into file.php: see, attached, my patch proposal file.php-MS01.patch.

I guess the same applies to 2.0: I'll take a look at it, too.

Matteo