>Anyone can build a custom extension to do anything an extension is allowed to do

Yes, that's why google moved to manifest v3 and extensions can't do as much.