My evil extension|browser may know what porn I watch or which sites I am visiting or possibly lift some bits it is not supposed to have. But it does not have access to Apple's comprehensive graph of my digital activities on their devices. Only Apple Inc. has that access.

So in fact the OP needs to put in the readme that "malicious browser extensions are a potential attack surface."

As a matter of fact, one could argue that a posting like this on Hackernews could potentially be a very sophisticated 'human engineering' effort by parties that have backdoors to browsers but have been defeated by Apple's security features.