If, say, an anti-virus program extracts an RPM's contents and scans each file separately, then it might miss files smuggled in that would be readable by malware with a custom cpio extractor.