I can duplicate what you're seeing with your audit query...it shows public still has GRANT S on sys.check_constraints for me but again in practice users that are only in public cannot select from it, they get permission denied. It's odd, really. Possibly a bug.

edit: had reply screen up for a long while at same time Lowell was replying so didn't see that before replying, reading that now...