Chrome extensions can steal plaintext passwords from websites

How is this even a story? It’s like being surprised that applications can access files on your computer.

https://news.ycombinator.com/item?id=37364709 from yesterday

Don't extensions need to seek user permission? I feel certain that they do, but it doesn't seem to be mentioned.