Is CISA-Use-Cases /Case-7/ valid example

in https://github.com/CycloneDX/bom-examples/tree/master/VEX/CISA-Use-Cases/Case-7 boms do not contain version of the software, but vex file affects sections contain versions or version ranges (i.e. https://github.com/CycloneDX/bom-examples/blob/7d529848e2f8bd65d03aec9eab16f139fd445ff4/VEX/CISA-Use-Cases/Case-7/vex.json#L169). So if I understand correctly, this vex should not apply to any bom as they do not specify any version, or the logic should be that if version is not specified then any matching bom with affects.ref is actually affected and in this case specifying version is irrelevant ?

What is the point of having affects section specifying also component ref and versions, if component ref is unique ? Ot is it just additional information ?