Usually, I restrict any extension to be "click to activate" and that works just fine. There is often no need to have anything running on every domain and every website. So it does ultimately become a whitelisting situation of my own configuration.