Question scopedRegistries !works from package?

Is this a bug, am I doing this wrong or this is intended?

For example, I have OpenUPM under scopedRegistries to pull some backwards support for Unity 2019 because of the wild dll changes (psst, why doesn't Unity natively handle this if they're gonna deliver such breaking changes?? But I digress).

If I copy+paste the scopedRegistries (not the dependencies; just scopedRegistries) from my package to manifest.json, my package.json can pull the dependencies np.

However, this adds friction to the end-user, having to ask them to add scopedRegistries themselves. Am I doing this right?