[xg15]

The thread contains lots of mentions of clipboard manager extensions which are apparently quite popular.

It should probably be put behind a permission, but generally I don't see how this is more problematic than an extension gaining full access to the page you're viewing.

[egfx]

This. When an extension is installed the privacy sandbox is removed. Google manually audits each extensions code and looks out for bad behavior. You cannot call out to external scripts or use mangled source code.