As it stands creating a schema extension for a user, means that the permissions needed to set that extension for a user requires User.Readwrite.All. Irregardles of whether you only want to update th...
https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-overview give you the ability to limit who can see, and update them.