I’m definitely no defender of Google’s most of the time, but this seems cut and dry. The user explicitly gave an extension the capability of reading their email. The alternative is for Google not to allow this and the extension having to have an unencrypted copy of your username and password to read email.
"Breaking: Google, the king of "you are the product", makes customers the product." FTFY
Don't like this any more than anyone else, but who honestly expected better from Google?