Basically nixpkgs.config.permittedInsecurePackages cannot be defined in multiple files at the same time, when this happens the value in the first file get silently picked.
This isn’t a parser bug. Nixpkgs does the merging of option values.
N.B. I’m not even sure if this can be considered a bug in configType, or expected behavior. If others don’t chime in here, feel free to file an issue I suppose.
The bug is because the option is not declared with mkOption. If it was declared then this custom merging would be unnecessary, and the option would actually become documented (!) in the nixpkgs config reference documentation.