I agree that automatically-updating extensions has the potential to be somewhat insecure. However, I don't see how the alternative could be a better alternative

I agree that automatically-updating extensions has the potential to be somewhat insecure. However, I don't see how the alternative could be a better alternative. If they didn't auto-update, then the majority of users would likely never update their extensions, and the ones that do would be unlikely to audit the extensions that they update for malware. Do you audit the apps on your phone before you update them? To mitigate the problem, Chrome does have the permissions model to limit what extensions can do, and if an extension requires more permissions after an update, Chrome will give you a warning, along with an option to remove the extension. Your best defence is to not grant overly broad permissions when you first install the extension. Regarding your comment about Chrome's automatic updates being "bad", I disagree wholeheartedly - the web platform would not be able to move forward at the same rate that it can today. One of the biggest problems with IE was simply that it was updated so infrequently that it was really hard to support the large percentage of outdated versions. We'd be in the same situation with Chrome if it didn't auto-update. Furthermore, I trust Chrome to make good decisions for my security. I'd rather have my browser updated quickly so that vulnerabilities in the browser can be fixed quickly before they affect me.