dotnet nuget why should check RID specific packages

[zivkan]

NuGet Product(s) Affected

dotnet.exe

Current Behavior

Add any package which eventually adds System.Runtime as a depenedncy. For example, System.Collections.Specialized. Restore will warn you about System.Private.Uri having a known vulnerability (when NuGetAuditMode is set to all, which is default from .NET 9). However, dotnet nuget why my.csproj System.Private.Uri will tell you that the package is not used by the project

Desired Behavior

dotnet nuget why should tell me why this package is being restored.

Additional Context

Looking at the assets file, the package is being included due to RID-specific (Runtime IDentifier) dependencies. Therefore, dotnet nuget why appears to be looking only at the "RIDless" package graph in the assets file.