[BUG] npm link and dependency hoisting don't play nice?

I am not 100% sure if this is a bug or I'm just misunderstanding the proper behaviour, but I don't really see a clear way to resolve it. I'm also having trouble building a minimal reproducing case because I don't seem to be able to play the npm link trick without first publishing the package I'm trying to cross-link.

Explanation:

Imagine a repo like this:

project-a/package.json:
  { "name": "project-a",
    "workspaces": [ "subproject-a" ] }
project-a/subproject-a/package.json:
  { "name": "subproject-a",
    "dependencies": { "webpack-merge": "^4.2.2" }}
project-b/package.json
  { "name": "project-b",
    "dependencies": { "subproject-a": "0.0.1" }}

I want to do local development on everything together, so I do:

( cd project-a/subproject-a && npm link )
cd project-b
npm link subproject-a
npm install

If I do something in project-b that requires webpack-merge, it generally won't be able to find the dependency, because it isn't anywhere in the upstream of subproject-a as it appears in project-b/node_modules.

I also observed the issue (already logged) that npm link updates project-b/package.lock with a file: reference.

EDIT: Also note that if I break ranks and run npm install in subproject-a directly, everything works according to plan.

Versions:

npm@7.0.6