Why does .Net v6 SDK flag vulnerable transitive dependencies previous versions do not

After upgrading to .Net 6 the dotnet list package --vulnerable --include-transitive command began listing older dependency versions with security issues. Here's an example using the Azure Function App template to create a project.

Projects/Test/AzFuncDependencyTest
❯ func init --worker-runtime dotnet

Writing C:\d\Projects\Test\AzFuncDependencyTest\.vscode\extensions.json

Projects/Test/AzFuncDependencyTest .NET v6.0.100  netcoreapp3.1 took 6s
❯ dotnet restore
  Determining projects to restore...
  Restored C:\d\Projects\Test\AzFuncDependencyTest\AzFuncDependencyTest.csproj (in 854 ms).

Projects/Test/AzFuncDependencyTest .NET v6.0.100  netcoreapp3.1
❯ cat .\AzFuncDependencyTest.csproj
<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFramework>netcoreapp3.1</TargetFramework>
    <AzureFunctionsVersion>v3</AzureFunctionsVersion>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="Microsoft.NET.Sdk.Functions" Version="3.0.11" />
  </ItemGroup>
  <ItemGroup>
    <None Update="host.json">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="local.settings.json">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <CopyToPublishDirectory>Never</CopyToPublishDirectory>
    </None>
  </ItemGroup>
</Project>

Projects/Test/AzFuncDependencyTest .NET v6.0.100  netcoreapp3.1
❯ dotnet list package --vulnerable --include-transitive

The following sources were used:
   https://api.nuget.org/v3/index.json

Project `AzFuncDependencyTest` has the following vulnerable packages
   [netcoreapp3.1]:
   Transitive Package                    Resolved   Severity   Advisory URL
   > System.Net.Http                     4.3.0      High       https://github.com/advisories/GHSA-7jgj-8wvc-jh57
   > System.Text.Encodings.Web           4.5.0      Critical   https://github.com/advisories/GHSA-ghhp-997w-qr28
   > System.Text.RegularExpressions      4.3.0      Moderate   https://github.com/advisories/GHSA-cmhx-cq75-c4mj

Compared to using the .Net v5 SDK. When I add a global.json to specify v5 no security issues are found.

Projects/Test/AzFuncDependencyTest .NET v5.0.401  netcoreapp3.1 took 1m42s
❯ cat .\global.json
{
  "sdk": {
    "version": "5.0.401"
  }
}

Projects/Test/AzFuncDependencyTest .NET v5.0.401  netcoreapp3.1
❯ dotnet list package --vulnerable --include-transitive

The following sources were used:
   https://api.nuget.org/v3/index.json

The given project `AzFuncDependencyTest` has no vulnerable packages given the current sources.

Why do different SDK versions produce different results?