There is an obvious exception: if you control the code. Many extensions have github repos where you can clone them and build your own version.

I have a long running personal extension where I collect all the functionality I need from open source extensions. Audit once, run forever with minor API updates every few years. The only third party ones I run are uBlock Origin and 1Password's official extension. With ChatGPT the audit/integration process has become loads simpler.

I even have a native extension bridge like 1password to interact with a Rust agent (to save and index visited pages, etc.)

Mozilla audits the code of the most popular Firefox extensions and tags them.