It’s dumber than that. The chrome extension requires *.facebook.com host permission. It can literally do whatever it wants - add friends, delete your profile, etc. You could write this same article about gmail, twitter, etc, any site in the world. The author just doesn’t understand chrome extension permissions