That is an issue with the current system too, sure an extension isn't able to look at arbitrary files in your system, but it still is able to look at your bank site, passwords, etc and can still do a ton of damage.

Web extensions aren't safe by default, you shouldn't trust them any more than any arbitrary EXE file.