Adding vulnerable ranges would work. Following the standardized SBOM fields is a better approach than adding custom properties. The ranges should be specific to a given package on a given software distribution (e.g. Debian 10), so I don’t expect there to be more than one vulnerable range in most situations.
I specifically asked about direct/indirect match to separate direct matches from matches based on the upstream package as discussed here. It would help us to filter out matches with less confidence. We could stringify the whole match details object and put it into a single property to include everything, but I have only use case for that one specific field.