I have a Lightning app -- a collection of custom object tabs, plus a couple Lightning component tabs. It should only be accessible to the admin, permission for which happens during installation via a perm set. In the App Manager, I have not selected ANY profiles to which the app should be assigned. It's that way on my scratch org, and that way in my packaging org.
However, when I package it and install on an Enterprise org for testing, the app is visible to all. When I go into App Manager, all profiles are sitting over on the right side, as selected.
Any idea why this happens?