I believe this is a problem with the extension API, where the extension needs to request "your data on all websites" in order to be able to run JS code in the context of the page/tab.

Technically if it's able to do this, then it is able to access the data on that page as well, whether or not the extension is doing so.