I also faced similar issue. In my project settings, "Frameworks, Libraries, and Embedded Content" for XCFramework is set as Do Not Embed. When I change it to Embed & Sign, privacy report contains frameworks info as well.