I really hope the "big names" are using dedicated clients. Web extensions are convenient and user-friendly (I'm using one now) but the attack surface is comparatively large.

No real getting around that tradeoff, other than encouraging experienced users to try different clients.