If the developer's extension store account were compromised or sold, they'd push an update to you that stole your data before you could react.