In this situation, Cursor did not make any reasonable attempts to check this extension really was from anthropic.

So for the analogy, it really is like Costco didn't make any attempt to check they were buying actual iPhones.