It's better to use something like piped that has the following features: https://github.com/TeamPiped/Piped#features
Yes and no. You can't be really sure. They might contain vulnerabilities https://portswigger.net/research/ublock-i-exfiltrate-exploit... not necessarily intended. You can read more here https://github.com/beerisgood/Security-link-collection , "Some examples why browser extensions are bad - since at least....."
>>And if they say they can't "read or change data on this website"? Extensions need access to those to make changes on webpages you visit. However, you can go to manage extension and limit to specific pages instead of all sites.
That's why Google is going for Manifest V3.
E.g. I use an ad-blocker to insert JavaScript only on one site: YouTube.com. But I use an anonymous dummy Google account for YouTube. So if anything gets compromised, I don't really care.