There is a massive difference between the supply chain risks of open source packages and actively fetching and executing remote code provided as user input like

There is a massive difference between the supply chain risks of open source packages and actively fetching and executing remote code provided as user input like the browser inherently does. The case of user provided extensions definitely falls a lot closer to the supply chain threat model.