Overly broad GitHub OIDC trust policy

A production deploy role trusts GitHub Actions OIDC with the condition below. What is the problem?

"Condition": {
  "StringEquals": { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
  "StringLike":   { "token.actions.githubusercontent.com:sub": "repo:acme/*" }
}