Is there another location they could? I'm not familiar enough with extension development to speak confidently but my understanding was that you had to manipulate the DOM if you wanted to impact I/O of the page
Per the post, if you click the button right in the browser menu bar, it spawns a chat window that’s outside the page DOM
Other than the post recommendation, using a secure "blank" iFrame hosted on their own domain might have worked as well, depending on their threat-model.