The System.SoftwareManagement.get_rpm_package_information() spawns out this rpm command
$ /bin/rpm -qa --queryformat \"%{NAME}\\n\"
and returns the result from the output of that command.
The System.SoftwareManagement.get_hotfix_information() method enumerates the /hotfix directory for .def files. for each .def file, it parses the contents and returns the results contained in those definition files.
You can be assured that if these commands return a component, then it means it has been installed into the system. Of course, if someone had command line access to your device, they could manually go into the /hotfix directory and create a random hotfix file and, in that case, that wouldn't mean it's installed on the system, but that's definitely an edge case. If all the software was installed via standard means, then the results of these methods will be accurate.
Why do you ask? Are you seeing the results from these calls returning information that you think is contrary to the software you have installed on your device?
-Joe