I would go further and suggest that you do not access any website or open any files via your browser while you have malicious browser extensions installed. You do not need this project's README to tell you this.

That's is a categorical error.

My evil extension|browser may know what porn I watch or which sites I am visiting or possibly lift some bits it is not supposed to have. But it does not have access to Apple's comprehensive graph of my digital activities on their devices. Only Apple Inc. has that access.

So in fact the OP needs to put in the readme that "malicious browser extensions are a potential attack surface."

I don't think your request is reasonable because I don't agree with your categorical assertion nor your risk assessment, not because I misunderstand the mechanics of your threat model.

"[A]ny app with Full Disk Access" requires yours truly's personal approval.

You acknowledge the threat is real yet say it is "niche".

And frankly, given that Apple can not possibly 'iKnow' more about me than myself, it seems running your 'niche critical but whocares' python server can only be informative to potential 3rd parties locked out of my Apple machine because they do NOT have been give permission by me to have "Full Disk Access".

When you install a browser extension, your browser will notify you if it can read or modify page content before you enable it the first time. Using OPs tool is not unique in that it becomes vulnerable when paired with nefarious browser extensions, because all pages are. Https doesn't even solve that.

This is akin to some medicine saying that if paired with another specific medicine, you won't get desired results, and you are upset that it doesn't include a warning against combining the medicine with cyanide because you might die. The pairing with cyanide is irrelevant to the medicine and is just a side effect of cyanide.

My friend you need to trust your LLM less here, this is extremely off base. If you have malware installed, the problem is the malware. Far more is at risk from it than some brand new dashboard that no malware has been sitting around waiting for. Malware will be waiting for API keys, bank passwords, your Internet connection to resale as a residential proxy. Things that will actually make them money. Your concerns are unfounded and misplaced.