Little tidbit I picked out of the development guide: Safari will automatically update extensions by checking a publicly-accessible plist file:

http://developer.apple.com/safari/library/documentation/Tool...

I think Chrome does this as well (I don't use it). Could this be related to their choice to require extensions to be signed? I'd think that anytime code is being automatically downloaded and installed, security would be a concern.