It's funny how the chrome store has skewed so far the opposite direction (kicking out extensions that claim they need http://*), but any Android app can claim they're a http:// handler.
The user has to agree to use that app to open http links.
Sure Google could kick this dev butt and ask them to use a more focused intent filter but that's way less of an issue than an extension siphoning all your web browsing.