[bagacrap]

If the developer's extension store account were compromised or sold, they'd push an update to you that stole your data before you could react.

[HWR_14]

You don't have to auto-update extensions.