This issue was discussed on the mailing list here:
https://mail.openjdk.java.net/pipermail/jigsaw-dev/2021-January/014632.html

The summary is that using --patch-module to patch an automatic module will re-create its ModuleDescriptor without "requires mandated java.base" when the patching adds packages to the module. The bug arises because the new ModuleDescriptor is created in non-strict mode, a mode that doesn't add the "requires" at build time.