Yes, you are right.

But the extension is a single point of verification, so can be easier to monitor it instead of checking every Nostr project that pop up every day. Of course it can become a single point of failure too, but open source + devs reputation is a good starting point.

Reproducible builds and a caring community could be a good addition.

Keys rotation / revocation / delegation probably the final solution.