Because when the JS files are updated the browser extension will have to fetch a new hash from the server, but how can that hash be trusted? The usual mechanism would be to RSA or DSA sign the JS files and have the extension validate the signature against a public key. However, we're still choosing to trust the server and hope that it's key is not compromised.