Yeah, thats definitely a false positiv!
All Activities with android.intent.action.VIEW in their intent-filter are intended to be launched from other applications without any special permissions. For example to allow app-links.
The Compliant Solution states that you have to define a (custom) permissions. But from the official Google documentation:
Creating a new permission is relatively uncommon for most applications, because the system-defined permissions cover many situations.