Do I somehow need to opt-in for Xcode to aggregate these? I saw that "Firebase" has a PrivacyInfo.xcprivacy with exactly the missing reasons I see later on when building. So it looks like nothing is aggregated here. I do not want to embed the whole framework to prevent bloating the bundle size

Oh thank you so much! I forgot again about this and it very clearly describing the issue, will try it later. Although I don't get why Apple does not just add the link to their EULA at the end in case I tap "use Apple's default EULA", but I guess that just fits into Apple's strange AppStore Connect UX decisions.