My mitigation for this: Any extension that I grant serious permissions, I copy it locally, and then install that copy. This effectively disables all updates! Still requires I trust the extension as is, but doesn't require I trust the extension developers forever. And I use this [1] extension to easily download the source for any other extension.

[1] https://chromewebstore.google.com/detail/chrome-extension-so...