Published date looks like Jul 8, 2025 but I ran across it today Jul 24. Affected extensions at least on Chrome seem to have been pulled at this time; haven't checked Edge, although I assume they would have been pulled too.

This feels like the same kind of issue as Google and Meta have with their advertising platforms:

They don't know what they're facilitating.

Which, in my opinion, means that their workflow is flawed and regulation is needed to prevent private companies from shirking responsibility for promoting malware to the general public.

If they own the platform (be it advertising or marketplace) it should be curated such that the platform's brand is at risk if bad actors are allowed on it.

They've been so proud of their ability to scale, but it's only "worked" because they avoided a lot of the hard problems, flushing essentially their waste products into the internet. Without punishment.