Beautiful, useful extension! But honestly, who installs (and keeps) extensions like this that require your absolute trust???

"Add CSS Peeper? It can: - Read and change all your data on the websites you visit."

Are there really no other less permissive options for extension developers?

Looking at what it does, that seems like a necessary permission and the whole point of the extension. You can always inspect the source code if you're at all unsure...

Couldn't they update the extension with malicious code at a later point without you noticing?

Where is the link to their repository. Couldn't find one on their site...