It's as though nobody realizes extensions can be created or purchased by sketchy actors and that this is a huge security risk when the extensions request "all access to all sites." OK, so when setting up an account's username and password and are provided 2FA codes or recovery codes -- those can all be compromised. How can you know an extension is compromised? It's almost impossible to tell with certainty.
Things like "The Great Suspender" incident get ignored and folks assume no other extensions have the same problems.
Things like "The Great Suspender" incident get ignored and folks assume no other extensions have the same problems.