The shared data on ios and android isnt all that important. Sure, you might not want a random app to read your photos, but it's not getting access to your bank session token. And these days you can grant apps to only specific photos.

The vast majority of extensions require the ability to read and modify the dom on any website to do anything. This is so much worse than the average app permissions.