I have a managed package that I have gone through the process to create Permission Sets and associate Custom Permissions to those Permission Sets. After much struggle I found that all of the components in that managed package are being enabled for all profiles, thus negating the point of creating a permission set with custom permissions. The profiles already have access to all the components upon installation of the package. I have looked through documentation but have not found where this can be managed in my package.
My question is how do I prevent all profiles from getting access by default. I do not create or otherwise assign permission to any profiles in any of the project metadata files (I don't believe) and am curious why all profiles gained access to my custom components/classes/permissions/etc by default upon installation of the package? How would I control this from my managed package?