If nothing else, basic logs of everything an extension does should be kept so that technically knowledgable users can take a look at the logs periodically (and maybe have them watched automatically by tools) to make sure everything checks out.