I built a chrome extension that is featured on the chrome web store[1] and the number of requests I get from shady data brokers looking to buy my extension and fill it with spyware is really concerning. A naive dev could build something cool and sell it off to someone thinking they'll maintain if for them but instead just cause a hazard for users. Google seems to do a decent job of reviewing the use of permissions but some extensions like mine really need access to everything on the page so I can only imagine what a data broker could do with it. Be careful what you install.
[1] https://chromewebstore.google.com/detail/css-selector-helper...