BDK signs using the sighash specified in the PSBT (or ALL if it's not provided). It's currently up to the user of the library to check that the PSBT they are signing doesn't have a dangerous sighash, but to avoid accidents it's probably better to have this check internally and force the user to explicitly opt-in to use non-ALL sighashes.