Of course, there does exist the serious problem of "extension installed by many people; extension abandoned by developer / extension swiped by criminal; extension updated with code that does Bad Things with existing permissions". That's real. And I'm sure that's why, when an already-installed extension (e.g. LastPass) has sensitive permissions (such as "access the clipboard", which is absolutely needs for key functionality), and the extension updates (which good, quality, actively maintained extensions do with some regularity), we get an intrusive, blocks the action the user meant to take, re-prompt to re-grant the (updated version of) the extension the (same) permission that it already had before.
It's not an easy problem, but I assert that the current "the extension updated, re-prompt" behavior is too simplistic, and a more user-experience sensitive, nuanced approach is necessary.
Factors which could be taken into account in deciding when to re-prompt for the permission could include "hadn't been updated for a long time until now", "developers / publishers / owners of the extension have changed", "size/ content/ API-call profile of the updated extension code have meaningfully changed".
Further, if some factors but not enough factors suggest that a degree of caution but not a whole "block the user until they re-approve" are appropriate, then some user experience in between the two should be deployed, e.g. a NON-blocking "Are you sure that this update is legitimate" message.
The specific nuisance which happens regularly with the LastPass extension is that the extension updates, and the next time the user goes to copy a password out of a LastPass Saved Site item in their vault, using the browser extension toolbar button dropdown menu, they get Firefox's "Do you want to (re-)grant this permission to this extension?" dialog, which completely interrupts the user's interaction with the LastPass browser extension. After the user answers the browser's blocking question, the LastPass dialog closes, and the user has to click again on the LastPass toolbar button, re-search for the site which's password they wanted, and only now they can actually copy the password. It's too intrusive.
