But the developer could have the base apps found in aosp that are required for xprivavylua to function. Weather the apps are actually installed wouldn't matter. For instance, in GB , one of the apps added to it's list is Gboard. Not every rom has Gboard.Because it depends on the installed apps and the user's choice.
XPrivacylua is a module to restrict apps to acquire personal information. It's up to the user to decide which apps shouldn't have access to user data.
Even applying it to all apps doesn't work, because the developer of the module (@M66B) can not know which apps will be installed on the device this module will be applied to.
Xprivavylua certainly doesn't need to leverage every app on the phone. So that rules out a select all. No module needs to leverage every app on a rom through lsposed. And to select all I'm sure would cause issues.