The bug

The behavior.melee_attack component has a field called reach_multiplier that determines the distance from which the attacking mob can hit its target. When it's set above 1 for example, it works fine.

When it's set to 0, you'd expect that the mob could never possibly hit its target. However this doesn't work, it hits the target anyway.

Vanilla

Creepers use this component as a hack to get them to chase the player, and their behavior file explicitly contains this comment:

"minecraft:behavior.melee_attack": {
  "priority": 4,
  "speed_multiplier": 1.25,
  "track_target": false,
  "reach_multiplier":  0.0 // this prevents creepers from ocasionally performing melee attacks while using this goal to chase
},

It doesn't prevent attacks. Creepers are affected by this as seen in this video:

https://www.reddit.com/r/Minecraft/comments/tvrs9q/if_you_swim_under_a_creepers_legs_and_make_sure/