Today, the [APK NAK handling is based entirely on file location](https://github.com/anchore/grype/blob/main/grype/matcher/apk/matcher.go#L265). This should be able to be applied to packages having no location information but instead the `ownership-by-file-overlap` relationship.