Apparently it strips the zeros so that 1.003 becomes to 1.3.

$ vercmp
usage: vercmp <ver1> <ver2>

return values:
< 0 : if ver1 < ver2
0 : if ver1 == ver2
> 0 : if ver1 > ver2
$ vercmp 1.003-4 1.3-4
0

Moving to pacman section

Wow, this looks strange. :-)

Basically pacman interprets versions as follows:
The "31" block of 2.6.31 means 31, not 31/100, so 2.6.31 > 2.6.8 (see kernel26, for example).

In our case we have a 003 block, which is interpreted as 3 (and not 3/1000). We have an explicit comment for this case in our code (/* throw away any leading zeros - it's a number, right? */), so this is in intentional.

I am not sure what to do here...

I think the current code is fine. The 1.003 < 1.2 issue is because 1.2 is really 1.200 or 1.003 is 1.0.0.3, upstream just do not know it! So either those versions should be used or the force flag. Anyway, it is obviously quite a rare case.

Of course there is always the whole epoch idea.