Hi, CycloneDX Team!
In real world, there may be cases when Syft or SPDX document lacks the data of source type, so when it's converted to CycloneDX ,no ComponentType can match empty string or "unknown". Hence the ComponentType should be defaulted to 'unknown', or it may be skewed.

Here are some relevant issues and PR:

1. fix: [WIP]introduce Component Type Unknown in Cyclone DX for better conversion anchore/syft#3833
2. Syft convert from cdx.json -> syft.json -> cdx.json fails anchore/syft#3574