I don't understand your point. It doesn't matter what the language is: JS, Lua, Python, C++ or even Rust. What matters is the API the extension has access to: tab URLs, web requests, storage, network, DOM read only or read write. Just like in mobile apps: it doesn't matter what language it's written in. It only matters what system apis it has access to.