Currently, apk does not consider a full package atom, including version ($pkgname-$pkgver) to match a package which matches that exact atom.
For instance:

# apk search -x linux-grsec
linux-grsec-4.9.20-r0
# apk search -x $(apk search -x linux-grsec)
#

This issue is present in all places where apk expects a $pkgname and receives a complete atom in the format returned by ‘apk search -x $pkgname’.
This behavior is counter-intuitive and leads to significant additional effort being required in parsing within scripts calling apk to strip the version, perform an operation with apk, then check the version actually retrieved.
apk should accept the full atom as returned by ‘apk search -x’, and throw an error if the version specified doesn’t match the available $pkgver.

(from redmine: issue id 7100, created on 2017-04-07)