It's possible that some here might confuse Web Extensions with Safari App Extensions. Safari App Extensions are not the same as Web Extensions. App extensions are written in native code (Objective C or Swift); they operate within Apple's sandbox; their data is saved within Apple's secure file system; and if they are sold via the Apple App Store, they are reviewed and approved by Apple. One never has absolute assurance that an app is proof against attack, but until I learn otherwise, I think Safari App Extensions are safe.
