So how does MyFunction know the value of abc
at the delayed function call (when it is called)
if the Private` context isn't on the $ContextPath?
because "CustomPackage`Private`" is the value of $Context when MyFunction is defined (i.e. it is not just $ContextPath that determines what a function sees but also what is on $Context).
TL:DR
This is a timely question because it indirectly touches upon the competing imperatives of developers and end-users. To the question itself:
The whole point of packages is that they are a form of encapsulation that allows developers to, without interferance, implement functionality for end-users without bothering them with the underlying details. In particular, the encapsulation involves controlling namespaces so that the underlying details can involve symbols that help implement the functionality but ultimately don't end-up polluting a user's namespace. All symbols defined in a "*`Private`" namespace are created for exactly this purpose.
Hence in the OP's example, the variable abc is an underlying detail for the implementation of the public MyFunction. The developer needs the "detail" of abc but this particular symbol is of no direct interest to an end-user who typically just ends up calling MyFunction[].
The package layout achieves this encapsulation by manipulating $ContextPath and $Context as the control-flow passes through the package when it is first loaded. This is described in the other answers and documentation but it can be useful to see it directly:
loc[n_] := Sow[<|
"Location" -> n,
"$Context" -> $Context,
"$ContextPath" -> $ContextPath|>];
Reap[
loc@1;
BeginPackage["CustomPackage`"];
loc@2;
MyFunction::usage = "MyFunction[arg1] adds 5 to arg1.";
Begin["`Private`"];
loc@3;
abc = 5;
MyFunction[arg1_] := arg1 + abc;
End[];
loc@4;
EndPackage[];
loc@5
]// Last // Dataset

When I load the package <the $ContextPath will have CustomPackage on it, but not CustomPackagePrivate
Yes, this implements both the public exporting of all CustomPackage functions but without polluting end-users namespaces with implementation details. In code around Location 3, all packages are cleared out thereby eliminating possible conflicts with existing abc definitions in currently loaded packages. This is encapsulation benefitting developers but the encapsulation benefitting end-users, as observed, is that on exiting (at Location 5) $ContextPath contains "CustomPackage`" (to provide access to MyFunction) but not "CustomPackage`Private`" thereby shielding users from symbols used in MyFunction's implementation.
A programmatic confirmation at Location 5 gives:
{MemberQ["CustomPackage`"]@$ContextPath,
MemberQ["CustomPackage`Private`"]@$ContextPath,
Context["abc"]}
{True, False, "Global`"}
At Location 3 in the control-flow, the symbol abc is not contained in any of the contexts defined in $ContextPath, ("CustomPackage`", or "System`") nor is it (yet) in the context defined in $Context ("CustomPackage`Private`"). Consequently, the name abc gets created in the context currently set to $Context. At this location $Context has value "CustomPackage`Private`" and hence the symbol CustomPackage`Private`abc is created. When the control flow then moves on to MyFunction[], "CustomPackage`Private`" is still the value of $Context so this function "sees" abc (hence it not just $ContextPath that determines what a function sees but what is on both$ContextPath and $Context).
Note how the convention of placing usage definitions at Location 2 is ostensibly for documentation purposes but its more important role is to ensure that the function goes into the package's context (see $Context at Location 2) before subsequently being made available in the implementation and for end-users (see $ContextPath at Locations 3 and 5).
IMO it is kind of cool how these placement protocols just work intuitively without necessarily keeping front-of-mind all the control-flow manipulations, variable-creation mechanisms etc taking place behind the scenes. Hence this means being very careful changing the framework but also IMHO the time is ripe for such extensions given that the line between users/developers may well be in the process of blurring.