It's true, but for large extensions that make use of bundled 3rd party libraries, it's hard to examine the code to determine with very high confidence there's n

It's true, but for large extensions that make use of bundled 3rd party libraries, it's hard to examine the code to determine with very high confidence there's nothing malicious in it. I also tend to watch a new extension's network traffic, but of course it's not foolproof either.