An extension with access to every URL can see every page you open, including the bank and the admin panel. Auto-update means the code you reviewed in March is not the code running in September.
The store listing is not a security boundary. A useful grammar tool can sell, get users, then sell the listing. The permission list does not shrink when the owner changes.
Practical rule: if the job can be a bookmarklet or a native app, do not install an extension. If you must, read the permissions. <all_urls> plus “read and change data” is a no unless you would give that vendor SSH to your laptop.
Enterprise: pin versions and stop auto-update, or do not allow the store. There is no third option that is honest.