People (usually) understand the words that pop up when an extension/app asks for permissions. But they don't necessarily understand the implications of allowing those permissions. And most have little grasp on how to judge an authors trustworthiness, other than the star rating on the store listing... which is driven by other users who mostly also don't have a clue.
It is not unusual to see stories of malicious applications or extensions with hundreds of thousands of happy users and good reviews.
It is not unusual to see stories of malicious applications or extensions with hundreds of thousands of happy users and good reviews.