When sending aggregate reports, the domain used inside <policy_published> should be (per RFC 7490) "The domain at which the DMARC record was found.". The report always uses the from_domain. However, the DMARC record might be found at a parent domain.</policy_published>
The correct domain, I assume, is supposed to be recorded through the "policy_domain" field in the "messages" table. The opendmarc-import script doesn't set that field, and opendmarc-reports justs uses the "domain" field in the "requests" table, wich is set to the "from" domain. Here's a patch to 1.3.2 that resolves this issue.