Since this directive is a 'must' I've changed the severity to 'serious' as per the meanings of those severity levels.
As I've come to understand it... since fwupd is in main and it
recommends a package not in main, then it violates policy 2.2.1
