The bar for extensions is lower than breaking the browser security model. The goal is to slip basic XSS attacks past the Chrome Web Store review process, which is a mix of automated and human linters.

People over-pemission chrome extensions all the time, so you can execute arbitrary JS on any site you want once the user clicks ok. Why bother finding security sandbox exploits when users hand you the keys without thinking.

The extension platform is trying to further isolate extensions, but Google's profit motive is in its own way. See: MV3 and the response.

If Chrome offered an ad-blocker built in to the browser -- and maybe a privacy-blocker too -- they could eliminate the entire extension platform and solve the problem.