That's a feature not a bug. Under flathub, the original author of the software (for verified apps at least) knows what is the best configuration to ship for their package.

ATM. You are not trusting flathub when installing a flatpak. You are trusting the application's author. Maybe in the future, flathub would introduce restrictions on certain permissions but we would be speculating at that point.