The fact that it has changed hands or not is irrelevant, there are valid use cases for ownership change, and there are many ways to "monetize" via malicious par

The fact that it has changed hands or not is irrelevant, there are valid use cases for ownership change, and there are many ways to "monetize" via malicious partner without selling the extension itself. What should be monitored are changes in the extension codebase that inject 3rd party scripts and/or modify the list of external endpoints the extension is exchanging data with.