> that way I don't have to bloat the browser's start-up time and don't have to "worry" about this extension spying on other websites, even though I realize it's unlikely
No need to worry about that, as it's limited by the permissions specified in the extension manifiest. So this extension can only access news.ycombinator.com and extensionpay.com to facilitate the Pro upgrade.
Well consider that when you go to a proxied version of HN, you're essentially giving an opaque server "permission" to view all your traffic it sends to HackerNews... but you can't verify what it's doing with that
At least this extension states exactly what permissions it needs, and I can inspect it and see what it's doing...
There used to be (and still are) things like https://mreidsma.github.io/bookmarklets/jquerify.html which allow to inject JavaScript on click (and thus would make it possible to transform that site), but I gave it a shot and HN is set up to disallow this:
Refused to load the script 'https://code.jquery.com/jquery.min.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://cdnjs.cloudflare.com/". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.