To me big potential issue about Metamask is if a compromised update got pushed out; a lot of damage could be done before people noticed even if it would be discovered immediately.