Wait...you can change the script the extension runs, at any time, without user notification? Yeah...no....
Also, there are no notifications when updating extensions anyway - not that you can prevent those updates or even bother reading the code. Nothing changes really from the perspective of the browser security model.