The salient difference is that bribing Google or Red Hat is practically impossible (a hypothetical billion-dollar exercise reserved for state actors); whereas b

The salient difference is that bribing Google or Red Hat is practically impossible (a hypothetical billion-dollar exercise reserved for state actors); whereas bribing Chrome extension developers is definitely not hypothetical, maybe even commonplace (e.g. some friends were hit by https://www.ghacks.net/2013/12/26/hoverzooms-malware-controversy-imagus-alternative/ https://www.ghacks.net/2013/12/26/hoverzooms-malware-controv... ). For high-value targets, like full access to a software developer's private github repos, there's definitely an economic incentive to do this.