Punching with a bare fist (or with an item with no damage component) has always dealt 2 damage instead of 1 in Bedrock Edition (MCPE-10700) even though the vanilla behavior pack sets the player's attack value to 1 and weapons and tools do 1 + tooltip damage (MCPE-62692). Presumably weaponless attacks were hard-coded to do extra damage so that an unarmed player would be able to damage mobs with armor, because armor would reduce 1 damage to 0 after rounding down.

The 1.18.20.27 beta/1.18.20.28 Preview made across-the-board changes to mob damage to allow mobs to give and receive partial (non-integer) damage amounts and to allow armor to reduce damage by partial amounts. Based on these changes it seems there is no longer any reason for the player's fist to do extra damage, so I expect Bedrock punches to be updated to do 1 damage. This would also be parity with Java Edition.

Note: by testing player attack values with a behavior pack, I determined that what the game actually does "under the hood" is that it applies the strength level 1 effect to bare fist punches, i.e. damage = floor( attack * 1.3 + 1 ). So for example, if you set the player's attack to 38 in the player.json then the punches do 50 damage. To update player punches to do 1 damage, then, what is needed is to just remove the strength modification from unarmed attacks.

Steps to reproduce

1. Spawn a zombie.
2. Punch it to death.

Expected result

The zombie takes 22 punches to kill, as it does in Java Edition. It has 20 health and 2 natural armor points, so each punch should do 0.92 damage and it should take floor( 20 / 0.92 + 1 ) = 22 punches to kill.

Observed result

Prior to 1.18.20.27/28 the zombie takes 20 punches to kill.
In 1.18.20.27/28 the zombie takes 11 punches to kill because floor( 20 / 2 * 0.92 + 1 ) = 11 punches.