For every user or shareable link, the calendar administrator can set a default permission for any newly created sub-calendars:
When a new sub-calendar is created, that user or link will be given access (or not) according to the default permission.
If you choose Not Shared as the default permission for a user or shareable link, then if a new sub-calendar is created, that user/link will not have access to it.
If you choose Read-only as the default permission for new sub-calendars, then the user/link will automatically be given access with read-only permission to any new sub-calendars that are added.
It's important to ensure that you set an appropriate default permission. If you're not sure, choose Not Shared as the default permission. You can adjust the permissions as needed if you find that a user or link does need access to a newly created sub-calendar. Having the default set as Not Shared ensures that access to newly added sub-calendars is not given when it might not be appropriate.