I was testing my metabase on a low permission profile (access to one dashboard, one database) and i try to subscribe to a dashboard. The problem was in the user selector i could see all my users. I think it's a security problem. What's more the user you subscribed receive a pdf with all the data present in the dashboard even if he doesnt have the permission to see the dashboard.
This is what Sandboxing (Data sandboxing: setting row-level permissions) is used for. If you enable Sandboxing in Metabase, then the instance will get into a multi-tenanted mode where it will isolate users and data. Otherwise it's a single tenant
Keep in mind that even if you enable sandboxing, users with higher permissions have to be mindful who they add to subscriptions. This is a documented behavior: