Just to prove my point that extensions have a wide attack surface.

authentication bugs:

https://blog.lastpass.com/2017/04/lastpass-2fa-bug-reported- resolved/

Information leaking bugs:

https://hackerone.com/reports/337189

server side bugs, rogue updates(all extension are auto-update by default), breaking security boundaries and more.