I'd say any extension that's making an http request that isn't just repeating URLs that are already in the page should show a toast notification with the reques

I'd say any extension that's making an http request that isn't just repeating URLs that are already in the page should show a toast notification with the request body prettified into legibility. A well made extension will only pop up an occasional toast. One that needs the server to work will show the toast when the user expects it to be talking to the server. One sending keypresses or other suspicious data will be really obvious.