I feel like this should be up to the affiliate networks to kick Honey out of their programs for TOS violations right? Or Google removing it from the Chrome store?
Alternatively, Manifest v3 is supposed to make things like this a lot harder. Users would need to activate the plugin rather than the plugin popping up all the time if I understand it correctly. Manifest v3 was designed to enforce better privacy practices in the Wild West of browser extensions.