App has unprivileged access to $HOME

The app after removed $HOME filesystem permission still has access to READ and WRITE into user HOME directory and below.
That should not happen (!).

Here are my steps:

1. Here is the default Flatpak sandbox config:

flatpak info --show-permissions com.jgraph.drawio.desktop
[Context]
shared=network;ipc;
sockets=x11;wayland;fallback-x11;
devices=dri;
filesystems=home;/usr/share/icons:ro;

[Environment]
XCURSOR_PATH=/run/host/user-share/icons:/run/host/share/icons

2. The first action i took was to prevent this app access to all user $HOME files, which is a default state, to a limited set. I used Flatseal to review and to remove the $HOME dir (I turned off the "All user files" switch), now settings are as follow:

flatpak info --show-permissions com.jgraph.drawio.desktop
[Context]
shared=network;ipc;
sockets=x11;wayland;fallback-x11;
devices=dri;
filesystems=/usr/share/icons:ro;

[Environment]
XCURSOR_PATH=/run/host/user-share/icons:/run/host/share/icons

3. The draw.io still has full access to my $HOME.

Start by reproducing the reported behavior with the default permissions and with the home filesystem entry removed, using the flatpak info --show-permissions com.jgraph.drawio.desktop output shown in the issue. Trace where the application or its Flatpak configuration receives home-directory access; done means access is unavailable after the home permission is removed and the behavior is verified again.