There is bug reported in SECDATA-1121 by Henry Donnay:
The data guidelines for rpm modules does not contain any information on which parts of the rpm "modularity" tag are needed for use of the VEX data and how the data should be used.
The linked issue indicates that the heuristic is not simple, so it should be specified.