What I don't understand is why Google doesn't offer users the ability to add some extension ids into some whitelist to allow them using very sensitive permissions.

Force those extensions to have an prominent icon on the UI with a clear tooltip asking "did you install this yourself [No]" for easy removal, in case someone else did install it without you knowing.

There are so many ways to make this work, but they have zero interest in it.