I also appreciate your efforts.
But:
this is for one package only.
Even we/techstaff would find a solution, it is so much easy to put a postinst script adding whatever you do not like. So security wise one would need to throw a look into each deb you install.

Another but: go ahead, please.
Fixing it one by one is our only chance.

--
Just to clarify:
I just wanted to express that a 'safe' package needs to be checked either way. One could use such sudoers or just some postinst script to break into your device. But this is surely not the thing here but probably mis-packaging (like sudser package which I re-configured pretty early). So I would propose to change this behaviour in the sudoers file.