Especially with the permissions you necessarily grant to this extension! The easiest way to monetize this is to sell it to somebody who will exfiltrate all your banking data with an invisible auto-update.
In order for us to be able to execute your scripts that do powerful things (send notifications, save to local storage, download things, etc.), our extension needs to have those permissions itself. Google doesn't have any way for us to say our extension itself only requires permissions x, y, z but give this user script permissions j, k, l.
Your browsing/page data is yours. That data is only accessed when you explicitly request to generate a script (i.e. can't generate a script to modify a page without seeing that page).