The security argument seems pretty simple. The end goal is that legit extensions that people regularly install should not need to ask for dangerous permissions, because a) it teaches the users that it's normal and b) since the extensions can become compromised later and abuse the permissions. Adblockers are probably the most common kind of extension, and are currently granted effectively unlimited access to read and modify every single web page you use. That's fucking scary.
If adblockers (and other classes of legit and common extensions) can be migrated to a safe API, it makes the unrestricted and dangerous API much more manageable since what's left is much less likely to be legit or something people actually care about. For example you can have enhanced review processes, warn users more forcefully about the danger, start limiting the power of the API, implement new safe APIs for some of the remaining use cases, etc.
EFF are smart people. They know what the actual security benefit is, and choose to instead argue against a caricature.
If adblockers (and other classes of legit and common extensions) can be migrated to a safe API, it makes the unrestricted and dangerous API much more manageable since what's left is much less likely to be legit or something people actually care about. For example you can have enhanced review processes, warn users more forcefully about the danger, start limiting the power of the API, implement new safe APIs for some of the remaining use cases, etc.
EFF are smart people. They know what the actual security benefit is, and choose to instead argue against a caricature.