Also
Malicious websites is a little redundant, as the idea of running random code from any rando on the internet. The web is collectively and inherently malicious in nature. Just to varying degrees.
Also, Google is the one hosting this crapware. The turned a blind eye to the 85-99% of browser extensions that were obvious crapware, spyware, and all but the worst malware. They still will after this.
They aren't trying to protect users, they are trying to protect an ad monopoly while covering more anti-competitive interference with a fig leaf by calling it a crack down on "malicious" browser extensions.
They could also police the open sewer of an extensions store they run, or only allow validated projects to access the deeper hooks, or a dozen other things that would be obvious if there real concern was cleaning up the thieves market they have run for decades.
Biting the hand that feeds IT
