Where and how is this program specified? Can malware impersonate itself as a "companion program" and collect user activity data?

It's just specified in a manifest file in a specific location on Linux or referenced in a registry key on windows, so sure, if you already have malware running on your computer I suppose it could do that (assuming the messages sent by the extension contain browsing data) but there would probably be easier ways for it to collect your data.

The permission request should probably be reworded to make that more clear.