It's a surprise that there hasn't been more exploits through major extensions - or maybe they've just not been discovered yet - either by a malicious developer

It's a surprise that there hasn't been more exploits through major extensions - or maybe they've just not been discovered yet - either by a malicious developer or a repo being compromised. I keep them mostly disabled - just can't fathom why a simple extension (e.g. to pretty print JSON) seems to need the access levels on the install warnings.