Is there harm in applying passwords to built-in Oracle Roles like DBA, Connect, etc
These are roles required to function as those roles.  However, users cannot just use those roles.  They are granted to users by a DBA as required.  What they should be auditing is who has the role and should they have them.  To do that they will need to understand what the purpose of the role is. 

Many of the roles will be granted to few, if any, non-standard users. But some such as connect will be granted to almost all users. 

It may help them if you document those roles granted to not non-standard users.  Include the reasons they would/should be granted to a user.  It is not uncommon to create local roles to simplify granting access.  Theses should also be documented and identified as local.  Having such a document should make dealing with the auditors easier as it will show that roles are being managed.