I used to run dozens of extensions.

Then one day one got rogue and hijacked my accounting webapp with a phishing login. I noticed only because it wasn’t in my language and it wanted too many info

Now i run only extremely trusted extensions like bitwarden and the eff one (badger something)