It seems the verification code is using the 2.3 (or maybe just the latest?) json schema to validate documents regardless of the version in them. I noticed this while adjusting changes in the external references when migrating some tools to 2.3.

As an example, a 2.2 document using the 2.3 category label PACKAGE-MANAGER (with the dash instead of the underscore) like this is reported as valid:

      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceLocator": "pkg:oci/index@sha256:8101cc07b2a1b5ca4736130f602b3e03808d18706d931123aee866ad43b1b2d7",
          "referenceType": "purl"
        }
      ]

java -jar tools-java-1.1.0-jar-with-dependencies.jar Verify test.spdx.json 
WARNING: sun.reflect.Reflection.getCallerClass is not supported. This will impact performance.
This SPDX Document is valid.

I'm attaching the example SBOM to reproduce the problem: test.spdx.json.gz