This. Do not install any extension unless you absolutely need. Assume they all leak your browsing data.
Not familiar with Google but if you can just vibe code your own extension then do that.
Sooner or later, yes. What stops it , other than layers of imperfect process? And it's the perfect vector to exploit anyone who doesn't review and understand the generated code before running it locally