This is how GSuite works, no? I can subscribe to the calendar of anyone in my company. You have to change the visibility to Private to stop it showing the content to other people in the org, and even then it just shows up as "busy".