I can think of no valid reason why a (supposedly privacy-respecting) email relay service should require a browser extension to be installed.
This made me realize DuckDuckGo may not actually value privacy. I stopped trusting all of its services.
I can answer this one: they're fine with not knowing who anyone is, but they're trying to make sure that each account maps to one real person — they're trying to prevent spammers from registering thousands of accounts to use to send spam, and from continuously registering more accounts whenever they get banned.
A browser extension that feeds their service a heartbeat packet every once in a while from a particular IP address, is a Proof of Identity. It ties the email account accessed through that browser, to a browser installation of the extension, such that you can only actively use as many email accounts as you have devices x installed browsers (which might be a surprisingly high number to you, a normal person with legitimate use-cases for multiple email accounts; but is still a problematically low number compared to the number of accounts the average spammer wants to register — especially when most of those accounts get banned in short order.)
This is a workaround for the fact that there's as-of-yet no such thing as an "anonymous identity verification service" — something like an OAuth IdP that deduplicates users on the client-to-IdP side through strong identity verification on registration (photo of your passport, webcam picture with this hand gesture, you know the drill); but then protects client anonymity on the IdP-to-service side. If you had to SSO to your DDG email through such a service, then they very likely wouldn't be asking you to install the extension.
Doesn't the very act of installing something on your devices increase their technical ability to collect information about you and your devices? That doesn't sound very privacy-oriented.
Apple is a regular company and gets points for adding privacy features. DDG? “Nah, F that, they suggested I run code on my device for a brand-new unrelated service. Reprehensible.”
Most privacy oriented companies don't care about your data, but they need to be able to see diagnostic information about your session for when things don't work. Oh and guess what? Things don't work for many users due to all kinds of crazy stuff, with viruses, proxies, crap internet, crap browsers, crappier browser extensions, or just plain user stupidity causing 99% of it.
Diagnostic data and basic telemetry allows software engineers to find the root cause.
There are companies that do privacy but they’re usually too small to be noticed outside the crowd of extremely privacy conscious people.
Mozila is a famous one though. Yup, even after their Pocket fiasco and some more I do believe they try to real and long term privacy. DDG is just hustling to stand apart and then maybe hope for a financial exit. (Have had a really bad experience with the company, other than using their product - their search is unusable though - that told me they do not have a respectable culture as an organisation either).