This approach is a lot closer to Android. You actually can still run whatever you want... just the default security settings don't allow it.
If you do the right thing for your users first, this is what you do. You put user needs over developer needs.
There is a middle ground between letting any malware on the machine install whatever extensions it wants with no user consent, and banning users from installing extensions entirely.