to me seems a very simple first step: just require extention devs to notify people on owner change, possibly with a standard way... just a lil popup or icon ask

to me seems a very simple first step: just require extention devs to notify people on owner change, possibly with a standard way... just a lil popup or icon asking "extention X has been aquired by Y, it has permissions A, B, C, D, are you OK with this?"