In this case, we know that extensions are sometimes sold and updated maliciously. Having external arbitrary code is a legitimately concerning vector because it

In this case, we know that extensions are sometimes sold and updated maliciously. Having external arbitrary code is a legitimately concerning vector because it bypasses Google verification of the extension. Not that Google are great at their jobs in that case, but it's something. So it's not paranoia in this case, it's "we can't have nice things" because of real bad actors.