There is a middle ground between letting any malware on the machine install whatever extensions it wants with no user consent, and banning users from installing extensions entirely.

If you do the right thing for your users first, this is what you do. You put user needs over developer needs.