I was under the same impression. I've never developed a chrome extension, but just from following developer communities I thought I had seen complaints in the past about broad access to website data that the Chrome extension API required you to request.

Now that I look, it's probably a misunderstanding most of us have because of the lack of granularity in Chrome extension permissions: http://lifehacker.com/5990769/why-do-chrome-extensions-need-...

If you install an otherwise-compatible Greasemonkey user script in Chrome without appropriately adjusting the metadata, it will default to requesting access to all domains. I think these were more commonly used in the earlier days of Chrome, and contributed to this misunderstanding.

For what it's worth, the last time I worked on an extension was in 2012, and a friend did most of the work setting it all up, I just wrote some of the code. This was the impression that I was under, but apparently it isn't the case.

Moreover why would they have so confidently made a comment full of such misinformation?