Metrics from deployments are always exposed and are not whitelisted according to the exposed-subsystems attribute of the microprofile-metrics-smallrye subsystem.