Composer installs this module despite no dependency is given on it

Tour_ui is no longer supported and it's functionality is rolled into tour.

Thanks for the info, but it doesn't answer why Composer is installing this module.

That I can’t say. This module has no reference to tour_ui since that functionality was folded in.

Would manually search your lock file and see what could be referencing this

This is in my generated composer.lock file:

        {
            "name": "drupal/tour_ui",
            "version": "2.0.0",
            "source": {
                "type": "git",
                "url": "https://git.drupalcode.org/project/tour_ui.git",
                "reference": "2.0.0"
            },
            "dist": {
                // ...
            },
            "require": {
                "drupal/core": "^9.1 || ^10",
                "drupal/tour": "*"
            },
            "type": "drupal-module",
            "extra": {
                "drupal": {
                    "version": "2.0.0",
                    "datestamp": "1689967253",
                    "security-coverage": {
                        "status": "covered",
                        "message": "Covered by Drupal's security advisory policy"
                    }
                }
            },
            "notification-url": "https://packages.drupal.org/8/downloads",
            "license": [
                "GPL-2.0-or-later"
            ],
            "authors": [
               // ..
            ],
            "description": "Provides a UI to manage guided tours.",
            "homepage": "https://www.drupal.org/project/tour_ui",
            "support": {
                "source": "https://git.drupalcode.org/project/tour_ui"
            }
        },

So tour_ui module depends on it according to composer.lock.
But the tour_ui module does not even have a composer.json file - neither in the Gitlab repository nor locally when downloaded.
So that definition must be (wrongly) generated from something else, maybe by the packagist repository.

Maybe this problem does not occur if tour_ui would have a composer.json defined on its own.
Moving this to tour_ui as it looks like the problem needs to be addressed from there.