With regulated I mean, curated by a group of postgres committers for example. I do think extensions inside postgres are very prone to supply chain attacks, so it should not be managed the way npm is.
How npm is regulated? Anybody can publish their package on npm as they can do on GitHub. There is no up-front review on npm. Only packages that are clearly harmful to the community are removed from npm.