That's a good question, Judith! I actually don't think I was thinking of the Simple Alert use case when that feature was introduced, but it would make sense that any reasonable person would think it'd apply to both email sent via a simple alert, as well as an advanced alert. So, I lean toward bug.
However, if what you are after is simply whitelisting a set of users who are allowed to use VizAlerts, you can do so simply by including them in a filter on the subscriber_sysname field in the config viz. VizAlerts will not run any alert that does not show up in the results of the VizAlertsConfig/ScheduledTriggerViews viz, so if you simply set an inclusive filter on there for the people you do want, you should be able to achieve the same thing.
I'm actually trying to whitelist using vizAlerts by site. So I have the default parameter set to 0 and for the action enabled email calculation is using logic to set it to 1 for specific sites else use the default. Based on your response, I think I could add a filter on this field and set it to 1 or I could add a filter on the site name instead. Would you recommend one option vs the other?
I'd filter out all other sites entirely, if it were me. You can always duplicate the viz and analyze it independently if you want to see if anyone on another site is using it, and getting confused when they don't get anything (hey, you could build an alert for that! ). But I'll add this to the list of Issues in GitHub so that a simple alert will be considered an Email Action that you can control the same way as Advanced alerts so we can improve the experience.