homepage field not filled in WebformSubmissionForm::validateFormValues

The Honeypot module adds a hidden field "homepage"

The Honeypot module adds a hidden field. The default field name is "url".

Honeypot elements do not have that #default_value set.

Correct, the default value is not set and should NOT be set. The only way this hidden field should have a value is if someone entered a value before submission. If it has any value at all, even a default one, it should fail validation.

Fetch form submission data from $form_state->getFormObject()->getEntity()->data and use that in HoneypotService::addFormProtection() as #default_value.

This is wrong for two reasons:

1. The hidden field should not have a default value.
2. getEntity() works only if you have a form that implements EntityFormInterface. MOST uses of honeypot do not attach the field to an entity form, and in those cases this suggested code will cause an error.

It's not clear to me what you think the Honeypot module is doing wrong. Honeypot is using the Form API correctly, as far as I can tell. If some other module is assuming something about the Honeypot form element that's not true, that other module will also be making the same wrong assumption about other form elements. The problem is with the assumption, not with the module (Honeypot) where the assumption is wrong.

Re "homepage" field name: I already gave the field a different name here in my setup, and so I looked up the docs → which said "homepage".

Re default values should not be set: Webform module expects #default_value to contain the value of a submission when it is submitted programmatically, so my patch only set the default value when such a programmatic submission is available.
I understand your point that you're using the Form API correctly. I'll reopen my webfrom issue #3366746 🐛 Honeypot fields not filled in WebformSubmissionForm::validateFormValues Active and request that webform should fill #default_value of honeypot fields for programmatic form submissions.