[CivBase]

I think the difference here is that browser extensions are distributed through a package manager provided by the browser vendor. People expect the vendor to perform some sort of security validation on apps that it is effectively publishing. You can't reasonably have the same expectation for binaries downloaded from a website.