I used this version trick in nuget, but the other way around.

To update existing non-maintained public packages, mostly because they were on. Net framework and a lot moved to .net core.

In visual studio you can set the priority of where packages have to be checked. My own package repo has a higher priority.

I never thought about using it as an attack vector though.