It’s quite possible that a malicious takeover is only diagnosed after the fact. Updates might appear innocuous at first but later be incredibly user-hostile.

I'm not familiar with extension development or their capabilities, but perhaps the extension author can remotely activate the malicious parts after it passes the update process and perhaps Mozilla doesn't have the manpower to manually review the code of every extension update?

I think that's the difference between "monitored" and "unmonitored" extensions, as called out in the article. Monitored extensions are presumably ones where they actually verify the updates, and so they think it's fine to let them run on sensitive sites.

Why do you say easily? Software is an endless parade of creative exploits both intentional and accidental, it's never seemed like an easy problem to solve.