Suppose there are 10 Nostr WebApps; you can't trust all of those apps, and entering your private key inside a browser every time you log into some WebApp is inherently unsafe.

Since the extension is already open source, you are not placing trust in anyone and please backup your nsec, this is the only way you can access your account.