Currently, if requirement for module is listed multiple times, the version from the last declaration overrides any previous requires. This can produce unexpected behavior when there are duplicate declarations with versions. This can happen when including multiple files; we use git submodules with cpanfile included into main project with "do". But this could happen with large files or merges. This could produce an error.
It would be better if the versions from the declarations were combined. Versions are combined with a comma to produce version ranges. Illegal ranges produce errors in CPAN::Meta::Requirements. CPAN::Meta::Requirements handles combining ranges to produce the inclusive range.
I don't think this has to be done on this layer. Carton actually manages this by using CPAN::Meta::Requirements like you suggest. Module::CPANfile is a utility to parse the content of cpanfile, and interpreting them should be left up to the utility that uses cpanfile.
Merge multiple requirements for a module
Supports multiple requires lines with versions. This is useful when
combining files with duplicates module declarations. Versions are
combined with a comma to produce version ranges. Illegal ranges
produce errors in CPAN::Meta::Requirements.