Dependency confusion can still happen when using scoped gem servers that don't implement a dependency API

Describe the problem as clearly as you can

Following up on my successful test backport (#4687), I've tried to run the test[*] with Bundler 2.2.20 and Bundler 2.2.21 (but maybe in not in a very smart way). The test fails, although it was supposed to be fixed.

This was prompted with a failing shell reproducer, from one of my collegues, which AFAICT is doing exactly the same thing, as in the Bundler test, but it is failing with Bundler 2.2.18+.

[*] Test name: bundle install with gems on multiple sources with source affinity when a top-level gem has an indirect dependency and the dependency is in both the top-level and a pinned source installs the dependency from the top-level source without warning

Post steps to reproduce the problem

I've taken Ruby 2.7.3 sources, and replaced the Bundler in them with Bundler 2.20.21. Then I've run the backported test:

https://gist.github.com/08e9423766b83a8fb0e5e1a64fa4ca74

Additional

Is there something I'm doing wrong, or is the test really failing?

I've run the test test from rubygems git repository as well, and it did succeed (with Ruby 2.7), although I had to do a workaround to make it work.

Start with the named Bundler test, “bundle install with gems on multiple sources with source affinity,” and reproduce it using Bundler 2.2.20 and 2.2.21 as described. Compare its behavior with the linked shell reproducer and RubyGems test; the work is done when the scoped-source dependency case is consistently handled without dependency confusion.