Thanks!
I thought this statement was explicit enough.
In general: One shall always use pkcon for managing packages on SailfishOS!
If its slightly slim feature set is not sufficient, one may resort to zypper (which has to be installed per pkcon, first).
Only use the very low-level package management tool (rpm on SailfishOS) for queries (i.e., rpm -q …) or if you absolutely have to, which is solely the case at the recovery console (which also shall only be used, when you absolutely have to).
BTW, this also applies to other Linux distributions, e.g. Suse (use zypper, not rpm), RedHat / Fedora (use dnf / yum, not rpm), Debian (use apt / aptitude, not dpkg), Ubuntu (use pkcon / apt, not dpkg) etc.
P.S.:
I still wonder about this assessment, because in my experience one can simply ignore the warning and the SailfishOS update works fine.