Earlier quoted context omitted.
and you are essentially trusting the moral integrity of the current maintainer. why can't there be a method for making sure that such trust cannot be abused? Is this a tractable problem at all?
I don't think there's a solution for it after all. At the end of the day, you need to trust someone / something, unless you are the one who writes the whole code. Which browser are you using?
I do think that reproducible builds would make a lot of sense for open-source browser extensions. Google could say "if you want your extension to get a Trusted Build tag, put the source code on Github, and we'll run the build script for you to ensure that the code submitted for store review is built from the code from a specific Git commit." And from a security perspective this would be better than what we have, which is zero guarantee that an "open source" extension even matches its stated repository. I'd trust the integrity of Google's automated build systems more than an independent developer with nothing to lose and everything to gain by sneaking in a third-party script.
Alas, the presence of this kind of reproducible build system would bring needed clarity to the chaotic ad blocker market, and the lack of that clarity works in Google's favor as an advertising company, so sadly I doubt they'd do such a thing.