I was just about to report the same issue, still a problem with 4.3 beta. The relevant JPA section for this requirement is JPA 2.1 section 2.3.3:

"The access type of an embeddable class is determined by the access type of the entity class, mapped superclass, or embeddable class in which it is embedded (including as a member of an element collection) independent of whether the access type of the containing class has been explicitly specified or defaulted."