In this situation…

.
├── package.json
├── test.js
└── lib
    └── test.js

package.json:

{
  "files": [
    "lib",
    "!test.js"
  ],
  "devDependencies": {
    "tap": "*"
  }
}

In ./test.js:

// Correctly no node/no-unpublished-require error.
const tap = require('tap')

In ./lib/test.js:

// Incorrectly has node/no-unpublished-require error!
const tap = require('tap')

The node/no-unpublished-require error rule incorrectly thinks that ./lib/test.js is published, causing the error. It does not seem to understand that negated globs apply recursively to files. !test.js prevents the file from being published in the nested files/folders; testable by running npm pack.