Then you have to disable all extensions, because others might be vulnerable as well.

If you only install trustworthy extensions (whatever that is :/) and can avoid installing a malicious one, it doesn't matter if the other installed ones are vulnerable. You have to install a malicious one to trigger it, they just use the vulnerabilities in other extensions to hide from review.