False. When they rolled this out i was trvially able to replace the allowed extensions id's with a root shell and they downloaded and worked just fine. Also, a website is also downloading and execing js, the same as an extension.