Which is pretty much what all other Debian package maintainers do. For Debian users it's expected they ensure the software they are packaging fits in with the Debian way of doing things. This is what Debian users want -- if they wanted all packages 'nude' with no changes applied there are other distros e.g. Arch that are much better suited. I personally tried other distros which tries to package as close to upstream as possible, and I was pretty surprised by the poor upstream defaults of many packages and lack of useful utilities. E.g. Apache is so much better packaged by Debian -- it wasn't until I installed Apache in Arch that I realised many of the useful stuff I used in Debian was actually Debian-specific. Most packages in Debian come with very good defaults that my "setup" script (i.e. install/configure packages) for my Debian machine is literally <50 lines whereas for Arch it was something like 200 lines including due to having to reconfigure a lot of not-very-well-thought-out upstream defaults that Arch kept in place.
KeepassXC consider these options as "plugins", it's right there in their official documentation for the build options.
The Debian package wasn't shipping the correct default configuration in the first place, it's unfortunate but better late than never, and it's not like you can't switch to the keepassxc-full package.
Which is in line with how many other Debian packages work which is again why I think this isn't really a big issue from the perspective of a Debian user. Most of the upset seem to be coming from users of other distros unfamiliar with the Debian approach to doing things. I do agree it's annoying that this wasn't done from Day 1, but better late than never.
In this instance the maintainer of the Debian package for KeePassXC has unilaterally made a choice.