Just because some users do insecure things doesn't mean that I get to do insecure things as a developer. They can choose to take security risks with their data. I cannot choose that for them.

Does Google not review the extenstions? Or is it using just some automated easily gameable review system?

AFAIK there's no review system, unlike firefox addons.

Not true. With expanded permissions (like access to all browser tabs), you will be subject to a full code review. I've had to wait anywhere from 2-5 business days before a draft extension was allowed to be published.