Yep, I know it's sounds scary, but I believe it's the only way for the Web Reader extension to work. I don't do anything malicious (just trying to upsell you on the premium plan) but I'd completely understand if you were freaked out by that.
An alternative is to use the bookmarklet, which will only run javascript on those pages where you explicitly clicked to open it, it works exactly like the extension:
Srsly?