Permissions-Policy allows any origin
Permissions-Policy grants at least one feature to * , so every origin may use it.
Why it matters
A framed page from another site can then use that feature in your origin's context.
What to do
Set each feature to () or a named allowlist. Do not use *.
Reference
Permissions-Policy should not grant powerful features to every origin.