Why does "bom-ref" field for each vulnerability in the top-level "vulnerabilities" field get auto-populated with a UUIDv4 if the field is optional in CycloneDX format?

[fetsko]

Why does the "bom-ref" field for each vulnerability in the top-level "vulnerabilities" field get auto-populated with a UUIDv4 if not supplied when the field is optional in CycloneDX format? Doesn't it make more sense to simply omit the "bom-ref" field if it is not supplied?

[jkowalleck]

Each bom-ref might be used as a bom-link - see https://cyclonedx.org/capabilities/bomlink/.
To enable anybody to do this, a bom-ref might auto-populate.