it's how browsers work. if you want the extension to provide functionality to the websites you visit (e.g. the nostr web clients) then the extension needs access to that. and thus also can read it.

You need to somewhat trust any software that you run on your computer. just by the fact that it runs on your computer.