And there are cases where this has already happened: https://www.bleepingcomputer.com/news/security/-particle-chrome-extension-sold-to-new-dev-who-immediately-turns-it-into-adware/ There are probably more recent cases too, but this was the first one I could find.