Vicasso's updated "Installation Guide" (https://vicas.so/installguide) recommends that all managed packages be installed (or upgraded) using the "Install for Admins Only" option, so that the proper permissions are later granted via the packaged permission sets, ensuring that different types of users have different levels of access. If our packages are installed using the "Install for All Users" or "Install for Specific Profiles" options, all users or those users with the selected profiles will have full access to the managed package, as long as they have a valid package license assigned to them.  To ensure that the permission sets control the level of access each user should have, follow the instructions in this article to remove the unwanted permissions granted during the installation process.