Thanks for the feedback!
You raise a very good point. I want to see what others think but I tentatively agree that SwiftPM reserves the right to omit the associated resources if the bundle is not accessed using the provided accessor. The only supported way to access the bundle will be through the accessor provided by SwiftPM.
@NeoNacho also suggested that the build system implementations can use an unstable UUID for the bundle name to make it difficult to find it using some other mechanism.