This bug isn't reproducible in RHEL 9.3, because the `scap-security-guide` RPM package shipped in RHEL 9.3 installation image already contains the data stream ID without the `-1.2.` suffix, so there is no difference between the IDs in the content in the installation image and the content in the repository, so the bug can't happen.
For the resolution on RHEL 9.0 z-stream, please track the 9.0.z clone: https://bugzilla.redhat.com/show_bug.cgi?id=2223964