Limitations for Deploying Profiles with Salesforce Packages

UI Package Installation

When installing a package through the Salesforce Setup UI using the install link, you are presented with three options: Install for Admins Only, Install for All Users, or Install for Specific Profiles.
If you select Install for Specific Profiles, you can map the values of the packaged Profile to an existing Profile in the target org. This profile mapping allows the package's permissions and settings to be applied to a specific existing Profile in the subscriber org. The documentation for installing packages describes this mapping behavior, and the values that can be mapped to existing Profiles are listed in the profile settings documentation.
If you select Install for Admins Only or Install for All Users, the Profiles included in the package are not used during installation.

CLI Package Installation

The Salesforce CLI package installation command (force:package:install) supports only two options: Install for Admins Only and Install for All Users. The Install for Specific Profiles option — which enables profile mapping — is only available through the UI installer. This means that automating profile value mapping during package installation is not currently possible using the CLI.
The CLI installation command defaults to Install for Admins Only. Use the --securitytype parameter to specify Install for All Users if needed.

Note for CLI Package Creation

When creating a package version using the Salesforce CLI, any Profile properties in the included Profiles that are not related to the packaged metadata are automatically removed from the Profile during the package version creation process.

Additional Details and Behavior Clarifications

Install for Admins Only grants full CRUD (Create, Read, Update, Delete) access to the packaged metadata — such as Custom Objects and Tabs — only to the System Administrator Profile in the subscriber org.
Install for All Users applies the same CRUD access to Custom Objects to all Profiles in the subscriber org. However, note that CRUD access to Custom Objects is still only fully granted for the System Administrator Profile.
A recommended workaround for managing access as part of a package is to use Permission Sets instead of Profiles. Permission Sets are better supported in packaging and offer more flexibility for distributing access across subscriber orgs.