It's not buggy, this is simply how it behaves.
As with any "library" and any "abstraction", it inevitably implements only a fraction of the hardware's features, in what the authors deemed "usual usage". Most of the people are probably OK with the SPI signals being threestated outside the transmission window, probably framed by some slave-select signal or something similar. In exchange for the limited number of usage modes, you get the clicky (CubeMX), ready-made examples, and a promise of easy migration to other STM32 models/families.
There's also the Cube/LL, which is mostly a rename of the registers, marketed as middle ground between Cube/HAL and register-level access. There's some clicky support for that, too.
It's upon you whether you are happy with this, or you want to exert more control.
As it may have perspired, I don't use Cube.
JW
PS. Cube is open source, so you can freely observe how it works, and you can also get inspired.
