Currently when we validate a configurable component, we find property descriptors that identify controller services, and we validate that that selected service matches the required API. This is done by checking that the bundle coordinate of the API exists in the bundle hierarchy of the implementation. Since this comparison is an exact match on bundle coordinates, it doesn't take into account for the scenario where the exact bundle dependency was missing, but there was one other bundle with the same artifact id so it was auto-selected.
As an example, if you took the latest NiFi release of 1.11.4 and you added a controller service NAR from 1.11.3, such as nifi-dbcp-service-nar, during start up the dependency of nifi-standard-services-api-nar 1.11.3 would be missing, but nifi would auto-select the same NAR from 111.4. Later if you took a processor like ExecuteSQL and selected a DBCPService from 1.11.3, you would get a validation error saying that the processor requires the API from 1.11.4 but the service implements the API from 1.11.3.