This is a tracking issue for support for annotated generics in the analyzer. The DAM analyzer only validates annotations for generics at callsites to generic methods:

This needs to be extended to cover all type references which may reference generic instantiations, including:

• base/interface types of a type declaration
• variable declarations
• field/property/event declarations
• parameter/return types of methods

This is probably best done using the symbol-based callbacks (RegisterSymbolAction) rather than the IOperation-based ones.

I would start by enabling some of the tests in GenericParameterDataFlow (or temporarily copying them to DynamicallyAccessedMembersAnalyzerTests.cs if that's easier). For example DerivedTypeWithOpenGenericOnBase looks like a good starting point.