I've used the local play mode with deactivated AI to try out how many hits on what location it takes and I've found that if I aim at the chest of an unarmored bot a pistol kills with 2 hits, but if I aim it so that I would hit the heart, but the arm of the bot is in the way, then it will take 3 hits. I think that is a bug, it should scan like 1 meter deep past the point of impact to see if there is another bodypart and then it should count as 1 hit, using the damage multiplier of the more vulnerable body part. It seemed to me, that for leg, hits where another leg is past the first one, it sometimes counts like 2 leg hits, but I didn't test that extensively. I think it would be best to always count 1 bullet for 1 hit, and take the most vulnerable bodypart on the line of trajectory to calculate damage. Arms (or weapons) blocking bullets only makes the damage-model/hitreg in a game feel inconsistent and frustrating, I think that really should be avoided.
Also I think an AKM hit to the chest without armor should be a 1-hit kill, but it seems to be a consistent 2 hit kill, which I find immersion breaking and not-fun. Leg damage multiplier could be higher as well imho. FAL/EBR on legs without AP ammo used to be 1-hit kills, AKM now needs 3 and pistol 4 iirc (didn't test legs too much). If armor is supposed to mean something in the game, imho the legs need to be one of the vulnerable zones, not "armored by default".