Up until 6.5, I could prevent the installation of all the qmltooling plugins via windeployqt --no-qmltooling.

These are totally useless when distributing an app and might even be considered a security risk.

This doesn't work anymore with 6.5, as there's no separate QmlTooling module, but modules/Qml.json specifies "plugin_types": ["qmltooling"], instead and that pulls in those plugins without any chance to prevent it from the user's side, as soon as the app uses QML.