I see the some people did not get point and thought it's a clickbate, so i've update post to explain the developer can be a bad engineer who failed to detect a scam and this is the potential problem of any extension.
You may think you can detect any scam, but scam may be targeted and complex