It is not a user’s expectation of responsibility - they aren’t going to track that an extension’s automatic update turned it from a coupon clipper to a surveillance engine. If we make this the user’s responsibility, there would be immense harm.
Maybe then auto-updating is the problem here. Why can't users have the agency to decide if they want to update or not? I know Microsoft/Google for one spearheaded the whole It's For Your Own Good movement, but opting out should at least be an option...
