An extension can steal personal data and manipulate pages with Manifest V3 APIs just like before, it does not become any harder for extensions to compromise browsers. There may be an argument that it becomes a bit less performant to execute the JS required to thoroughly compromise a browser, but I don't think such malware cares about microsecond performance losses.