Answer
This is by design, not a bug — Static Code Analyzer only supports source model files and their respective implementation files, for a specific set of file types (client, projection, fragment, app, plsql, views, storage, plsvc, offline). RDF is a generated file, not a source model file, so it's outside SCA's scope entirely — there's no equivalent SCA coverage for report/.RDF changes, and that's expected rather than a gap that needs fixing.