I use only very few extensions. If they're open source, then instead of installing them from the browser's store, I maintain them as AUR packages. [1]

That way I force myself to build them from source.

My habit is also to inspect the changes between upstream releases. It's mostly spot checks, but it's better than nothing.

[1]: https://aur.archlinux.org/packages?O=0&SeB=nd&K=firefox-exte...