It's not normal and shouldn't be allowed to become some dystopian new normal.
IMO this permission is something that Chrome should explore, along with other fine-grained permissions. It might be worth making a bug report to Chromium so you can link it when people ask why you ask for such broad permissions. I think the bug report should probably mention that Google uses go links :)
It would still be possible to create a permission that makes it so the code that edits a page can't make any network requests (the output would need to be HTML sanitized, including links), and I'd like to see that, but it would be more difficult to design, implement, and communicate to users.
It's not ideal but in order to make utilities that work on every page, these permissions are needed.
The code inside the extension bundle (.crx) would need to contain the potential for abuse, and if it gets popular enough, security researchers will look at it. Even if it's not popular, incentives will be at work, because it would be a foolish risk for a company to ship code that could expose a user's entire browser history into the extension, because at any point someone could take a look at the bundle and find the flaw.
If you take a look at a company like Grammarly, they've built trust with their users, which is why they can have the "Read and modify all data on all sites" and still have 10 million customers. We plan to build the same trust with our customers.