A plugin can read everything on every website you use. Your bank statements, your emails, which videos you watch on youtube, to whom you talk on Twitter and what you write with them, what you search on Google ... everything.
A bookmarklet can only read what is on the page on which you invoke it.
We already have the system in place for things like Camera, Mic, and Location access. Why not extend that to anything an addon can do?
https://homepages.inf.ed.ac.uk/imurray2/code/mastodon.html
It's maybe easier to just use a separate app though, and avoid the faff of separate webpages entirely.
It’s how I run grammerly, which is a descent enough grammar checker except I never want it to correct my chat posts, or GitHub comments.
And on the plugin page for Grammarly, it says it gets "Access your data for all websites":
As far as I understand it, all that has to be done is something like:
document.body.innerHTML.replace(/<some_regex>/,'<some_string>')
@someone@someinstance.tld
<a href=https://yourinstance/web/@someon@someinstance.tld>@someon@someinstance.tld</a> javascript:url=document.querySelector('link[type="application/rss+xml"]')?.href ?? 'None'; alert("RSS found: "+url);{}