* "What the extension can do" is very poorly specified, using language that casual computer users won't understand

* The granularity of permissions is poor so in some cases one operation requires a seemingly unrelated permission. (Android historically has had this problem too)

* While Google have recently made some steps towards improving this specific issue, per-website permissions are something that WebExtensions barely handle. You can technically put a specific list of domain names in your permissions list, but if a site changes domains or adds a new subdomain your extension won't work until you push an update that requests the new permission... and that update will disable the extension for everyone on the planet until they dig around in the UI to find the permission request warning. The last time I checked Google's new solution for this was to allow the end user to narrow the 'access everything' permission to specific websites, which is... something, I guess.