I don’t think it’s a bug in the package, at least technically. Maybe @jonringer can answer that more definitively.
My rough understanding is that the nix+python ecosystem has some (historical?) quirks wrt to propagation and dependency leaking, and that this is more of a ~systemic issue than a package bug. There’s ongoing WIP that I think aims to address this issue in WIP: Python: wrap and patch using `requiredPythonModules` instead of `propagatedBuildInputs` by FRidh · Pull Request #102613 · NixOS/nixpkgs · GitHub (and maybe others).