Extensions may need to access the DOM, including password and other sensitive fields (e.g. for autofill and password managers).
That's indeed what Google has said in response:
>A Google spokesperson has confirmed that they're looking into the matter, and pointed to Chrome's Extensions Security FAQ that does not consider access to password fields a security problem as long as the relevant permissions are properly obtained.
This definitely feels like the wrong approach. I think they should be moving towards deprecation of this permission, and replacing it with what the extension actually needs.
That's why it is always a risk to use browser extensions and you really have to trust the people behind the extension.
Obviously, if the browser supports it, the access should be limited to the sites where it actually matters. Like a YouTube ad blocker to youtube.com. Unless you make a living from YouTube. Then you don't want to block ads for ethical reasons as well as security reasons, because it can kill your livelihood.