> weird popups, overlays in the browser viewport, extensions that sneakily inject ads into pages, and track user behavior _still exist_

all of this is possible to do with webextensions, just add a contentscript for all_urls. Of course webextensions help with some security issues, but not with the ones you mention.