> That cannot be "just replicate"d for javascript extensions.

This is false too. If extensions aren't allowed to communicate with the internet and can't auto-update themselves, then they also can't run arbitrary code without the user's consent.