If you want to fight for security on that level, your computer life must be miserable. You are also missing out a lot of great tools and are way less effective then folks that use them (and thus less competitive).
I am all up for great security in OS, emails, browsers, messangers etc, but it has to stop somewhere. Also, this kind of stuff like vimium is so widely used that somebody would probably notice if something funky is going on (everything leaves some traces, you dont really need to look at the code to notice it most of the time).
Your proposed way to solve this issue is way worse - now, instead of having one monolitic but still simple and well rounded app you have thousands of little scripts that combined are also hessle to review, belong to way more humans with different agendas (instead of single or couple) and would be horror to initialize (really sounds like nodejs ecosystem).
Just get the damn thing and relax a bit. Anything malicious that could be done by some developer is already done by big evil corps anyway (and more) and you cant really escape those.
Life is risky by default. You calculate your ods.
I sometimes install plugins myself if the code is open source and it is small enough for me to vet it.
I would love vimium, but the code is way too big to vet it myself.
I wish there was some party that is trustworthy, vets codebases like these and publish hashes of trusted versions.
An alternative would be more modular codebases. So instead of publishing a giant box of code with all kinds of vim-like behavior, publish lots of small ones. Like the code to make gg work.