Can you point to a specific comment where someone saw the behavior unexpectedly?

I've only seen people that saw the addon being installed unexpectedly.

That doesn't lead to thinking any sites have been hacked.