It's not a bug.
Order of declarations is important.
When you do an association like this, what PlantUML is doing is creating a black dot to connect the classes, if you put the association outside of the package, it creates the dot outside of the package.