'users' is an extremely broad category. I don't think there's a one size fits all solution. There's probably some hundred million users who can, on average, make good decisions about extensions. There's also hundreds of millions of users who are children or are otherwise unable to make good decisions about extensions. Google, corporations in general, will force a 1 size fits all solution even when it doesn't, because it is cheaper/more profitable.

How am I supposed to understand whether extensions are stealing my data?

I've made browser extensions and I find it difficult to make an informed decision!

It is not a user’s expectation of responsibility - they aren’t going to track that an extension’s automatic update turned it from a coupon clipper to a surveillance engine. If we make this the user’s responsibility, there would be immense harm.

Maybe then auto-updating is the problem here. Why can't users have the agency to decide if they want to update or not? I know Microsoft/Google for one spearheaded the whole It's For Your Own Good movement, but opting out should at least be an option...