Alby might be worse since they have access to all your internet browsing if enabled as well as all your receives and spends. I just wouldn't keep more funds on Alby than you're willing to lose and use it only with websites that you want to Alby to interact with
Discussion
The Alby browser extension is a fully client side application. No data is shared with any party externally. Ally data is stored locally. You can have a look at the open-source code. But I agree it might be a bit surprising why all these permissions are needed. Here you can read more about it: https://guides.getalby.com/user-guide/alby-browser-extension/faqs/what-permission-does-the-extension-require