The description of cc:actionSource "targets" says this:
"... If present, this must be a space (not tab) separated list of client ids (relative to the top level component) of components within the <composite:implementation> section. ..."
The current implementation uses findComponent over the top level component. The effect is components inside the composite component but outside cc:implementation can be affected by "targets" definitions.
Usually this does not happens, because different ids are used. Anyway, the spec is clear in this point.