What are the rules surrounding third-party builds and forks with the same name?

[gamer191]

Many users use package names instead of package IDs. Doing so means that the user isn't specifying which author they want the package from.

For some packages (eg gyan.ffmpeg) it makes sense to use third-party builds, because there are no first-party builds available. However, for most packages there are first-party builds, so I'm curious whether this repo would accept third-party packages (with a different package ID)? What about forks that add new features but don't change the package name?
Also, if a fork changed the package name to something like ffmpeg+ or ffmpeg-plus, would there by a risk of it being downloaded if --exact isn't used?

Basically, is running winget install --source winget PROGRAMNAME safe, or do I need to also use --exact and --id?