It's disappointing but some nation state sponsored attackers are either adopting useful addons or creating them from scratch. After they have a sufficient base of trusting users they update the addon to add spying code that activates for a group of accounts possibly targeted by geolocation. The vast majority of users are not even affected. So with that going on it's hard to be certain of an addons quality.

I'd consider where the addons are hosted. Firefox and Chrome both allow reviewing existing addon permissions so disable when not required or split into risk level profiles for personal vs work vs anon browsing.