>why won't Google/Mozilla prevent this by making an extension and a person's account inseparable

This can be gotten around easily by making a separate Google account for the extension. It would require using gmail rather GSuite (without transferring over the entire GSuite domain.)