You've not supported calling can() on the package. You've also not supported the correct behaviour of can() on methods that actually were defined directly in the PUBLIC class. Such as the constructor, or (now) can(). (A list to which which the user of the module could choose to add.)

However you're right that someone who wanted to write the AUTOLOAD and then tried to add can() after the fact likely would implement just that and not notice the omissions. (Nor would the testing mantra help - you can't test cases that you didn't think of. And testing AUTOLOAD is harder than it looks because of how much behaviour even a short AUTOLOAD provides to write tests for.) Which illustrates by example my point that even when people try, they'll repeatedly get it wrong.