Stuff like this makes me wonder why Chrome's security model allows things if it can be scanned and deemed unsafe. Isn't it preferable to bake such restrictions

Stuff like this makes me wonder why Chrome's security model allows things if it can be scanned and deemed unsafe. Isn't it preferable to bake such restrictions into the extension API if Google didn't want PushBullet to go beyond it? Why does this need to be enforced by an app store?