It's the Accept: header coming from a random third party, not the plugin.
My hosting doesn't log that header, but I'd guess that third party is sending an Accept with incorrect casing.
The .htaccess RewriteCond didn't pick it up, so didn't add the Cache-Control:vary suffix.
However, the ActivityPub plugin matched the header regardless of case and returned the activitystreams json as expected. Which may be correct behaviour in itself.
It is then returned for all Accept types