I think there's some confusion on versions.
As I mentioned in my original post, this happened to me running the latest
release of both yara and yara-python, 4.0.2
*/usr/local/Cellar/yara/4.0.2/*
*/usr/local/lib/python3.7/site-packages/yara.cpython-37m-darwin.so
This issue is probably related to this change:
https://github.com/VirusTotal/yara/commit/b7da5d2835cc4cf8a15027da30265addab1a4be5
Old versions of YARA had a weird behaviour when the NOT operator was used
in conjunction with MATCHES or CONTAINS on undefined values. Your old
version of yara-python
