Answer
Database object grants for a package work across two separate mechanisms: one table stores whole-package-level grants for a permission set, and a completely separate table stores specific REVOCATIONS for individual package methods (procedures and functions) against specific permission sets. A permission set only needs the package-level grant to access any method in that package by default — a specific method only becomes actually blocked once an explicit revocation record exists against that particular permission set for that particular method. Since no revocation record can exist yet for a brand-new method that didn't exist before, it's automatically accessible to every permission set that already has package-level access, until someone explicitly revokes access to that new specific method for whichever permission sets shouldn't have it.