For example, a security group rule has this import ID:

Security Group Rules can be imported using the security_group_id, type, protocol, from_port, to_port, and source(s)/destination(s) (e.g. cidr_block) separated by underscores (_). All parts are required.

Also, resources don't necessarily have a Name arg. Some do, some don't. And what that name means depends on the resource.

For many resources, you don't have to provide a name arg if you're not importing, and then Pulumi generates a name from the 1st parameter plus a random bit. This will obviously never match what's in the cloud.

So to prevent this mismatch, you pretty much always have to provide the Name arg for any resource that support it, when importing.