pull down to refresh

I don't think your concerns are misguided. Browser extensions in general can be a security risk. Even if you carefully check permissions, extensions are often updated automatically.