debian/rules:

dh_auto_configure --  -DWITH_TESTS=$(WITH_TESTS) \
	                      -DWITH_GUI_TESTS=$(WITH_TESTS) \
	                      -DWITH_XC_UPDATECHECK=OFF \
	                      -DWITH_XC_ALL=OFF

CMakeLists.txt:

set(WITH_XC_ALL OFF CACHE BOOL "Build in all available plugins")

option(WITH_XC_AUTOTYPE "Include Auto-Type." ON)
option(WITH_XC_NETWORKING "Include networking code (e.g. for downloading website icons)." OFF)
option(WITH_XC_BROWSER "Include browser integration with keepassxc-browser." OFF)
option(WITH_XC_BROWSER_PASSKEYS "Passkeys support for browser integration." OFF)
option(WITH_XC_YUBIKEY "Include YubiKey support." OFF)
option(WITH_XC_SSHAGENT "Include SSH agent support." OFF)
option(WITH_XC_KEESHARE "Sharing integration with KeeShare" OFF)
option(WITH_XC_UPDATECHECK "Include automatic update checks; disable for controlled distributions" ON)
if(UNIX AND NOT APPLE)
    option(WITH_XC_FDOSECRETS "Implement freedesktop.org Secret Storage Spec server side API." OFF)
endif()
option(WITH_XC_DOCS "Enable building of documentation" ON)

set(WITH_XC_X11 ON CACHE BOOL "Enable building with X11 deps")

# stuff inbetween cut out

if(WITH_XC_ALL)
    # Enable all options (except update check and docs)
    set(WITH_XC_AUTOTYPE ON)
    set(WITH_XC_NETWORKING ON)
    set(WITH_XC_BROWSER ON)
    set(WITH_XC_BROWSER_PASSKEYS ON)
    set(WITH_XC_YUBIKEY ON)
    set(WITH_XC_SSHAGENT ON)
    set(WITH_XC_KEESHARE ON)
    if(UNIX AND NOT APPLE)
        set(WITH_XC_FDOSECRETS ON)
    endif()
endif()

I'm no CMake expert, but it looks like to me, from the first line of the above snippet, that the default in the upstream build script is WITH_XC_ALL=OFF.