It's by default. Regardless of the permissions for related sites of login user, it will add links of all sits that associated hubs and associated child hubs in the hub site navigation.
As a workaround, you could set Audiences to target for added links.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.