The 'problem' is the package, not dynamic SQL.
Roles are disabled/invisible in stored procedures/packages. You cannot use privileges granted to roles in packages, only privileges granted directly to the user.