GitHub made recent changes where the default GITHUB_TOKEN may trigger other workflows using a workflow_dispatch or repository_dispatch event trigger.

Relevant blog post: https://github.blog/changelog/2022-09-08-github-actions-use-github_token-with-workflow_dispatch-and-repository_dispatch/