Yes, there seem to be really valid security concerns about the current extension interface. Perhaps Google is making the wrong tradeoffs here. I don't know, it's very complicated, but the article is not really engaging with those tradeoffs.