>>If the extension has a ton of reviews, doesn't it sort of vouch for credibility?

Yes and no. You can't be really sure. They might contain vulnerabilities https://portswigger.net/research/ublock-i-exfiltrate-exploit... not necessarily intended. You can read more here https://github.com/beerisgood/Security-link-collection , "Some examples why browser extensions are bad - since at least....."

>>And if they say they can't "read or change data on this website"? Extensions need access to those to make changes on webpages you visit. However, you can go to manage extension and limit to specific pages instead of all sites.

That's why Google is going for Manifest V3.

The big issue has been trusted, harmless well-liked extensions where the developer gets offered a nice shiny payout, transfers control to WeSellYourData Inc, and now everything feels the same except for the surreptitious tracking of everything you do.