Extensions are limited though.

One simple example is an extension can't see cross origin iframes. This means it could never do soemthing like fill out a payment form for you if it's an extension.

Limited computation and action space is another as well as bot detection systems.

For example a javascript method trying to automate something like microsoft word in an iframe will have a tough time because the second you inject code in there they will block you.