Only the toplevel app is able to override. So overriding in a package in hex is quite senseless, as it probably will never be the toplevel application.
Imagine a scenario where I am using your package :foo and the overridden package :override. You are overriding to version 2.0.0, and I want to use ~> 1.1.0. How much time do you think would be spent trying to figure out why a different version than what I told the system to use is actually downloaded?