That is certainly true, and it is equally true that that possibility places a responsibility on you to put that in a section in your readme.
So yeah, I may have a bad extension but that thing never had access to the possibly aptly named 'IntelligencePlatform' that's keeping tabs on my digital activities, until I ran your code. Correct?
My evil extension|browser may know what porn I watch or which sites I am visiting or possibly lift some bits it is not supposed to have. But it does not have access to Apple's comprehensive graph of my digital activities on their devices. Only Apple Inc. has that access.
So in fact the OP needs to put in the readme that "malicious browser extensions are a potential attack surface."
As a matter of fact, one could argue that a posting like this on Hackernews could potentially be a very sophisticated 'human engineering' effort by parties that have backdoors to browsers but have been defeated by Apple's security features.
Also, small correction: any app with Full Disk Access can access this data.
You acknowledge the threat is real yet say it is "niche".
And frankly, given that Apple can not possibly 'iKnow' more about me than myself, it seems running your 'niche critical but whocares' python server can only be informative to potential 3rd parties locked out of my Apple machine because they do NOT have been give permission by me to have "Full Disk Access".
This is akin to some medicine saying that if paired with another specific medicine, you won't get desired results, and you are upset that it doesn't include a warning against combining the medicine with cyanide because you might die. The pairing with cyanide is irrelevant to the medicine and is just a side effect of cyanide.