TFA is a github page, friend. If you truly care about compromise as stated, just build the add-on from source. No reason to point to nonexistent future threat vectors.
https://arstechnica.com/information-technology/2018/07/styli...
The threat isn't nonexistent and having the source doesn't help as much as you might imagine. Most people can't read the source in any meaningful way and those that can might still trivially miss something malicious. In practice its only as safe as the meaningful analysis by skilled hands makes it in actuality. Realistically you would be lucky if someone notices several months after it started siphoning off your data and only if its egregious enough to get it kicked off of the extensions store.