When null literal is included in the list of values of the IN expression then if there is no match the expression should evaluate to null. It is the responsibility of nullSafeFilter() which wraps the whole filter to transform the null to false.
Currently the generation of the painless script skips the null values so it will not evaluate to null but directly to false. This can be problematic if the IN expression is nested under an AND or OR expression which requires the null to be returned in order to correctly evaluate itself using the 3-valued logic.