Off the top of my head, there are a couple of reasonable ways of describing what “url” might be expected to mean here. This ambiguity is why I prefer using more descriptive names in my own code.
They are:
A. “Which URLs should we include?” This would follow the behavior of a strict whitelist, so an empty array should “include no URLs”.
B. “Which URL filters should we apply?” This would follow the behavior of the search/filter field in an app that otherwise displays all data. An empty array here would mean “include no URL filters” aka “show everything”.
Of these two, it sounds like you’re describing that it behaves like B. It’s only a “bug” if the documentation describes it differently, or if you can find evidence that it was clearly intended to work differently. The documentation is not incredibly detailed, but it says it will “match tabs against one or more URL patterns”. This statement implies that providing fewer than 1 pattern is “incorrect usage with unspecified behavior”. This line also implies that what you’re entering here are “filters for URLs”, hence it seems totally reasonable that having “no filters for your URLs” would result in having all URLs shown.