Hacker News Reader

> they generally get access to everything you browse

They don't have to. Extensions declare which sites they want access to in the manifest file. Many extensions and user scripts only get access to specific sites.

They are approximately as big of a risk as any other third-party code you install from the Web onto your machine (e.g. tools from dev SDKs).

It is fairly trivial to audit the code to see what the extension is actually doing.