No, not really. Once I install the extension, unless I do something unusual, I've signed up to automatically download and run whatever code is signed with the right key and put in the update channel. If the dev isn't trustworthy, I'm almost certainly going to be hosed before I know I have a problem. Being able to see exactly how I got hosed, after the fact, is somewhat cold comfort.

Indeed - and extensions get sold all the time for fast cash.

What does Microsoft have to do with anything?

Well, they created an unauditable mess of an operating system with numerous security vulnerabilities while using their monopolistic hold on the PC market to hold back better solutions.

I disagree with GP's point about "enough eyeballs". Heartbleed et al showed us that bugs can lie in plain sight for years.