But still it is worrisome that we can configure visibility only by Administrators, yet everybody can assign the project as subscriber... Maybe that is a bug ?

@Higgs You should be able to Project → Edit Details → Visible To → Project Members. Does that do what you expect?

Our instance uses a ton of projects as "groups of people that need to be notified", so we use project subscribers a lot.