I mistakenly installed a Minecraft modloader for my son without checking it out first. It silently installed a couple of local Chrome extensions that injected ads in every page. It would reinstall them (again, silently) every time you deleted them. It wasn't detected by Microsoft Defender or Avast until I ran Malwarebytes which took care of the problem.

So, pardon my french, but no freaking way do I want any local Chrome extensions allowed by default anymore.

For extensions from the Chrome store, perhaps Chrome should make updates more like on Android, where you are notified and can click for more info.