Packages contain files owned by nobody
The SystemUID/SystemGID models check for an ID range between 0-1000, but the nobody user seems to also own files in some packages. This is considered unsafe/ a bug and the packages in question need to be fixed.
Edited by David Runge