It's a balancing act of security and opennes. Extensions so far had a really bad track record of having too much permissions. They could be detrimental to user'

It's a balancing act of security and opennes. Extensions so far had a really bad track record of having too much permissions. They could be detrimental to user's life if an extension can easily grab login cookies/credentials or whatever to your banking if you ever enter it in your own browser. I think more restrictions should be put on extensions but it's always hard to balance between accesible developers tools to people who know what they're doing and somebdoy writing down the instructions how to circumvent it to lure the user to install a malicious extension in developer mode.