From a security perspective, keep in mind the errors like "access denied" or "password invalid" are typically bad not good when compared to more generic "table does not exist" or "failed logon attempt".

These errors tell you something positive about the existence of something you don't have the rights to know about and that is a defect in my opinion.

I not saying good error messages are not valuable or that Oracle's are fine, but the answer should never be that error messages tell you information about something you don't have permission to know about.