I imagine ad blockers also use content scripts for things like blocking ads based on images that are known IAB sizes. In that case, they have another avenue to

I imagine ad blockers also use content scripts for things like blocking ads based on images that are known IAB sizes. In that case, they have another avenue to watch requests. I'd give the privacy angle more credence if they were really locking down everything. They aren't, because extensions would then be of very limited use.