Well I'd say the worst that can happen is an extension that compromises security of the browser to the point that malicious people can take control of your online accounts such as email, bank accounts, source code on github, etc.

That can happen intentionally but more often unintentionally. For example as you need to communicate between JS living in chrome (not the browser) and the webpage, it's easy to open a hole by mistake. Then someone could build a website to inject code to your browser and pretty much take control of your machine.

Yes Mozilla reviews the add-ons, but they are so many of them that they can't take the time to do a bullet-proof review. They only check for a few basic rules.