They used to be much worse. People ended up with a dozen toolbars, plugins, and extensions that hijacked their search to sketchy sites like "Internet Web Search" and injected random ads into the page.
As opposed to running scripts from random websites with zero oversight.
Browsers have the sandbox. Extensions are outside of it, within a different one, but the further up you go the more vulnerabilities there are.
You know how many right the average windows/linux/macos desktop application has?