Two different jobs, often one product
Secrets management is concerned with a secret's confidentiality and integrity: encrypted storage, controlled distribution, rotation on a schedule. Authorization is concerned with a different question entirely: given that a caller has legitimately retrieved a secret, what is it actually permitted to do with it? A vault can do the first job perfectly and have nothing to say about the second.
Because both are often bundled into the same platform, it's easy to assume that access-controlling the vault itself — who can retrieve which secret — is the whole solution. It solves distribution. It does not constrain what happens downstream, once a service has the secret in hand and is using it to act.
Where the gap actually bites
The practical failure mode is a service that can legitimately retrieve a broad credential — say, one with wide database access — for a task that only needed to read a single table. The vault did its job: the secret was stored and delivered safely to an authorized caller. Nothing after that point constrained the caller to the narrow thing its task actually required, because that constraint was never the vault's job to provide.