They’re simple enough that you can fork an open source extension and review the source with relative ease, freezing it.

I have my own omni extension made up of copy pasted open source extensions. I normally wouldn’t go through the effort but web browsing is crucial and frequent enough to be worth it and it took less than a weekend to get it up and running, especially with Plasmo. It’s also another reason to prefer Firefox and MV2

Who's got time for to review every open source project they use, thousands of lines of code though?

This is a fair call and something I should really do with the small enough ones.

It's the auto-update behaviour of browsers that should probably be criticised here, rather than having general distrust of all extension authors.