It does, and lists it again when you install the extension :) What I was getting at was that there are so many developers that just put in "*" out of laziness, when their extension might need access to only a handful of domains, or even just one.
Safari actually handles this pretty well. By default you will be prompted per-site which domain you want the extension to run on, or you can set your allow or deny all except your whitelist.
I really like Edge's "site access: on click" for extensions. Hoping for FF to add it at some point