Seriously. It is completely unacceptable that the default level of access has become "everything."
Even on Android (and I presume iPhone) where apps ask for/document their permissions requirements, most people just say "Yes" and move along. Most people have neither the time nor the expertise to critically evaluate whether or not an extension needs any of a dozen permissions.
I sympathize, but I have no idea how you can realistically solve this.
That seems ripe for more of the same articles of this flavor. The specifics would probably be just something akin to "turns out that using this permission in a way that Google didn't anticipate immediately gets your app shelved and leads to loss of users."
That's probably better than the scenario we have right now. Such a system of smaller permissions would be an improvement over every extension asking for all permissions and being able to do what they want with your browser.