Browser extensions were also one of the biggest ways to distribute malware. The situation was genuinely horrific. Malware distributors would offer popular extension devs millions of dollars to buy the extension, then silently insert malware which gets auto deployed to millions of people.

That sounds more like an issue with the update policies.

Why haven't they been prosecuted? And why hasn't this "cindyllm" bot account been deleted yet? Clearly a shadowban didn't send the message.