If the PB team hadn't gotten it to be as visible as it was, they very likely would have gotten away with it.

Regardless of that, just tell people what they've done wrong, developers are surely jaded by being told absolutely nothing about what or why some faceless mega corp is trampling all over their day.

Is it any wonder people like OP lash out in frustration and just pull all of their work when one has no means to obtain a straight answer? The man has a young child, and that is work enough, but it also puts things into perspective, and honestly, as a father of a months old child, I'd probably respond to this in the same way and think "fuck it, one less frustration" and just pull it too.

The PB post describes them removing permissions they realized they didn't need, you can check their writeup. Google's handling of this was poor but PB had real problems.

In this extension's case, we haven't even seen what notices Google sent.

That said, calling Google heavy handed is an understatement, and there have been several cases which have made it clear that kicking up a fuss online and being big enough to get some attention is the only means for recourse.

But Google just said "you're asking too much permissions". After the first fixes the extension got rejected again, without explanation.

And the other (I think more important) point was that we know even less about whatever happened to Kozmos.

Rejecting a fixed version is not lack of "hand-holding", and far-reaching permissions are not by default a "major security breach" (unless Google has a policy of shipping products with major security breaches built in?)