> The researchers explain that the problem concerns the systemic practice of giving browser extensions unrestricted access to the DOM tree of sites they load on

Ofcourse.

> Your data on all the websites you visit gives access to read, request or modify data from every page you visit (bank account, Facebook).

https://support.google.com/chrome_webstore/answer/186213?hl=...

If extension can modify your dom, well guess what - it can attach event listeners, it can make password to be posted to pastebin and so on.

That's why I don't install extensions that I don't trust that ask for this level of permissions.