It has been a thing for longer that extensions are not allowed to make connections to the internet, unless it’s actually required for the functionality they advertise. And I believe, they have some rudimentary code scans in place to check for that. Besides that, there’s also their Recommended Extensions program, where they do thorough code reviews for a subset of available extensions.