Double checked on SLE12-SP3: the problem isn't reported by rpm -V there, although the same permission mismatch exists. Probably a change in behavior of rpm. So this applies only to SLE15/Leap15 and newer.