This is a mischaracterization, if you read what the extension is used for: Showing popups when people visit certain sites. For example, popping up a notice to remind users not to upload Google data to Dropbox when they visit Dropbox.

So no, she wouldn't have "added arbitrary JavaScript". She would've added an additional message and triggering website to an existing script.