CPE is a joke. The offical spec doc asserts that correctness of names is not in scope for the spec. See section 5. Well-Formed CPE Name Data Model

https://csrc.nist.gov/pubs/ir/7695/final