If you don't have the ability to police extensions you're basically putting your users up for sale?
The problem you linked to also happened on desktop because there is no VSCode for phones.
Swap packages for extensions in the above and let me know how that's different
If anything, wouldn't a phone extension be more sandboxed than most desktop environments?