VDR "affects" information incorrect after hierachical merge

I have VDR files for two components (Docker images), each with subcomponents (libs, OS packages, etc). Each VDR file correctly links a vulnerability to the corresponding subcomponent. However, if I perform a hierarchical merge of the two VDR files then the affected component is always the newly created top-level component. Therefore the link to the sub-component (lib, ...) and even to the component (Docker image) is lost. This feels wrong, especially if a vulnerability contains analysis information which may only be applicable in the context of component A but not component B.
```
cdx merge --input-files foo.json artemis.json --output-file product.json --hierarchical --name "Final product" --version 1.2.3
```
merges [foo.json](https://github.com/user-attachments/files/23579378/foo.json) and [artemis.json](https://github.com/user-attachments/files/23579382/artemis.json). As you can see in [product.json](https://github.com/user-attachments/files/23579387/product.json) `affects` is always Final `product@1.2.3.`
The merge was done with version 0.29.1+e7b6ea2ec2a95e705e8fa7a88ad5ac9dbfa7912d of the CycloneDX CLI.

See also https://cyclonedx.slack.com/archives/C01DRP0543Y/p1762856918912369.