Here's the proof-of-concept extension by gorhill for anyone interested: https://gist.github.com/gorhill/b0316e35d4e7e4a44df39e8b7fa5.... Looks like his tweets regarding this have also been deleted.
I personally do not see the point of considering this specific issue particularly severe because the Chrome Web Store already allows extensions to execute remote code in extension context simply by declaring `unsafe-eval` or `unsafe-inline` (or specific remote hosts) -- and one can find such extensions quite easily.[1]
If the Chrome Web Store had a policy of "no remote code execution in extension context under any circumstance", then the issue would definitely have been high severity.
* * *
The result back then was that the reported behavior is in accordance with the CSP spec, so the issue was closed.
Maybe Chrome should change their default CSP for extensions that haven't declared one though to disallow blob: URLs.