It seems like it shouldn't let code originating from the site (as opposed to from the extension) to access that.

I'm not sure you'd need to directly fetch to determine if they resolve. One could probably inject an img tag and see if it resolves.