It's also a security risk though, as in someone could take it over and push a bad update at any time... I have a few extensions installed but I'm terrified of adding more, even though there are parts of my browsing experience that could be significantly improved.

I really wish there were a middle ground, like an external extension manager where you could opt into updates, with reproducible builds, changelogs, etc.

My mitigation for this: Any extension that I grant serious permissions, I copy it locally, and then install that copy. This effectively disables all updates! Still requires I trust the extension as is, but doesn't require I trust the extension developers forever. And I use this [1] extension to easily download the source for any other extension.

[1] https://chromewebstore.google.com/detail/chrome-extension-so...

You could add it from source which is pretty easy to do but you lose chrome’s syncing feature.

Having said that I haven’t developed a chrome extension in years. They are so strict now. I know they can’t manually inspect each line but I do hope it helps solve the problem of extensions going rogue.