then you have an extension with full access to everything.

unless it's one of the big guys, devs either sell the extensions or get hacked, it has happened multiple times.