Currently --all-packages flag only adds/includes packages that don't have any vulnerabilities. It should also add packages that have been filtered out because it can't be scanned for whatever reason.