But they are risking something. As a Slack user, I find the temerity of this extremely annoying. I imagine that I'm not the only one.

If those enterprise customers are worried, they're free to lock down browser extensions on their employees' systems if they want. If they're worried about this, they should be just as worried about extensions acting on webmail, internal sites, etc.