This wouldn't happen with proper adblockers. Also, if a user or a malicious script has permission to install extensions, I assume it would also have permission

This wouldn't happen with proper adblockers. Also, if a user or a malicious script has permission to install extensions, I assume it would also have permission to toggle "enable extensions" setting.