In sql_mode=oracle, when an SP parameter of the VARCHAR data type is defined without length,
the length should be inherited from the actual argument at call time. This is how Oracle works.

This script works fine in Oracle:

CREATE OR REPLACE PROCEDURE p1(p OUT VARCHAR)

AS

BEGIN

  p:='0123456789';

END;

/

declare w varchar(10);

begin

  p1(w);

end;

/

This script:

declare w varchar(8);

begin

  p1(w);

end;

/

fails with an error:

ERROR at line 1:

ORA-06502: PL/SQL: numeric or value error: character string buffer too small

Furthermore, since Oracle 9, VARCHAR datatype in PL/SQL is not limited to 4000 char but to 32k.
It's the size of varchar column in a table that is limited to 4000 (until Oracle 12C which allow 32k when MAX_STRING_SIZE=EXTENDED).