... One malicious push/release effectively enables every user on browsers that have not transitioned to the passive list/filter model of blocking to be complet

... One malicious push/release effectively enables every user on browsers that have not transitioned to the passive list/filter model of blocking to be completely owned. It is not about intent, it is about the many many extensions out there that use this feature set for good intent, but inherently open the risk of a full on traffic funnel should they be exploited * the number of users for each of them.