When you point the localize command to a composeinfo.json, it does nothing. If you point it at a compose directory, it will download RPMs but the repodata for them.
It should download repodata from locations referenced in repositories, debug_repositories and source_repositories. There needs to be deduplication, as especially the source repo is likely going to be the same for all arches.