Entirely agree, although as a developer the auto updating is definitely a feature. Since it lets you assume users are all on the same version.

It is definitely a risk for users though.

You can also "opt out" of automatic updates, but the process is a bit involved.

1. Locate the extension on disk

2. Copy it to some other location

3. Add it as a developer extension via the "Load unpacked" button in the extensions screen.

I would also advocate for extensions being open source, but of course most of them are not.