> Evidently, app stores are sufficiently bad at detecting this that it remains profitable.
What percent of extensions connect/download from the internet? That could be an easy way to identify a much smaller group of vulnerable extensions. Make extensions request permission to connect, then you can see the smaller group and watch any new extensions that request the permission. Connections could also be domain restricted to a list defined before distribution (and IP connections banned.)
Also, Mozilla could force extensions to make requests through proxies it controls... although that would be a whole other issue.
The relevant extensions here (adblockers like uBlock vs. uBlock Origin, the author's extensions like adding a search-by-image button and removing +1s from GitHub) all have the ability to modify the web page that they're running on. If you have that ability, you therefore have the indirect ability to perform network access as that web page. Blocking the extension's own network access won't identify malicious behavior, and blocking indirect network access will get in the way of productive extensions.
Yes, you can imagine a way where extensions provide some declarative input to the browser saying how to block certain elements, and don't have any connection to the web page. That's more or less what iOS ad blockers do, as well as Chrome's new proposed ad blocker approach, and extension authors generally dislike it. And that only helps you remove elements, not add them - things like night mode extensions generally want to add either elements or at least CSS to the browser, and if you have that much access, you can definitely add ads or inject referral links into shopping sites.
What percent of extensions connect/download from the internet? That could be an easy way to identify a much smaller group of vulnerable extensions. Make extensions request permission to connect, then you can see the smaller group and watch any new extensions that request the permission. Connections could also be domain restricted to a list defined before distribution (and IP connections banned.)
Also, Mozilla could force extensions to make requests through proxies it controls... although that would be a whole other issue.