I feel like this should be up to the affiliate networks to kick Honey out of their programs for TOS violations right? Or Google removing it from the Chrome store?
The Chrome team seems like the one that would be most pissed about this. While some aspects of their management of the extension ecosystem are problematic, they make an effort regarding trust and security. The reason Honey has to be so aggressive in getting you to click a button in that popup window is the browser won't allow it to interact with the page (to swap out the cookies) until the user has affirmatively interacted with the extension on that page. That is intended to prevent extensions from maliciously manipulating third-party sites without user consent.
https://www.justice.gov/usao-sdal/pr/cookie-stuffing-interne...
Alternatively, Manifest v3 is supposed to make things like this a lot harder. Users would need to activate the plugin rather than the plugin popping up all the time if I understand it correctly. Manifest v3 was designed to enforce better privacy practices in the Wild West of browser extensions.
PayPal is one of the payment methods offered by Google for all kinds of things such as the Play Store, YouTube subscriptions etc. I use it myself for those purposes.
It might sour things between them?