> Am I understanding right the extension was free to download code from internet and execute with enough rights to scan the user's disk?

I honestly thought that was how the Javacsript and Python ecosystems worked? And surely many others.