It's possible to extract the extensions source, save it locally, and then manually install it. That insulates you from the risk of a malicious update.

(You could also audit the extension for complete safety, but TBH I'm usually too lazy to do that, and I assume that the risk of an extension currently being malicious is far lower than the risk of an extension later being updated to become malicious)