I also have some extensions with users in the tens of thousands and can corroborate all of this. Out of curiosity I strung one "buyer" along to see how much they would offer and they quoted $0.20 per user. With the amount of money being thrown about, as sad as it is, it's no surprise that some devs end up selling out their users.
In my opinion extensions have to be one of the worst sources of spyware these days. I am now extremely conservative with what extensions I use, and definitely would only use extensions from open source projects or companies that I trust.
Something needs to change. As long as extensions have such weak sandboxing along with such poor app review, Google/Mozilla etc will keep willingly shipping spyware unbeknownst to their users.
At least some mechanism of creating and verifying reproducible builds would go a long way.
In my opinion extensions have to be one of the worst sources of spyware these days. I am now extremely conservative with what extensions I use, and definitely would only use extensions from open source projects or companies that I trust.
Something needs to change. As long as extensions have such weak sandboxing along with such poor app review, Google/Mozilla etc will keep willingly shipping spyware unbeknownst to their users.
At least some mechanism of creating and verifying reproducible builds would go a long way.