This is true, but it's no different for userscripts either. Those can have more privileges than browser extensions do. Plus, some browsers like Brave seem to have some pretty good sandboxing for extensions, and notifications each time the extension updates and needs more permissions. I'd be willing to trust a browser extension installed in Brave than I would a userscript. Course, I only ever have 5 browser extensions at most, LassPass, Printliminator, SteemKeys, Dissenter (for now), and Stylus. So it's not like I use dozens of them either.