rdevlin.cronin@, could you please take a look or suggest another owner?

This is entirely by design. DOM modifications are how content scripts in isolated worlds are supposed to alter the content of the page.

you could read this api https://developer.chrome.com/extensions/content_scripts#pi
it tell us: 
Content scripts execute in a special environment called an isolated world. 
They have access to the DOM of the page they are injected into, but not to any JavaScript variables or functions created by the page. 

by this way,I can create, modify any JavaScript variables or functions in the page. then web data will be changed,then how to ensure that the user to read data has not been tampered and more.

	var script = [
		'var script=document.createElement("script");                                                                                                     ',
		'script.type="text/javascript";                                                                                                                   ',
		'script.innerHTML="hi=123;var info=234 console.log(hi,info);$.ajax({url:\'/jquery/test1.txt\',async:false});window.alert = function(){};window.confirm = function(){};window.onunload = function(){};window.onbeforeunload = function(){}";',
		'var html=document.getElementsByTagName("html");                                                                                                  ',
		'html[0].appendChild(script);                                                                                                                     ',
	].join('');

And Monitor user input at website is entirely by design ?

attach file is demo how to monitor user input.

Deleted: Animation.gif 1.2 MB

	Animation.gif 1.2 MB View Download

Adding a script tag to the document executes the script in the document's main world, rather than the extension's isolated world.  Yes, this is by design.  Isolated worlds are for stability and extension security from websites, not for website security from extensions.

If so,Whether the document should be revised .  They have access to the DOM of the page they are injected into, And to any JavaScript variables or functions created by the page ?

https://developer.chrome.com/extensions/content_scripts#pi

Execution environment
Content scripts execute in a special environment called an isolated world. They have access to the DOM of the page they are injected into, but not to any JavaScript variables or functions created by the page. It looks to each content script as if there is no other JavaScript executing on the page it is running on. The same is true in reverse: JavaScript running on the page cannot call any functions or access any variables defined by content scripts.

That's all still true, but when you add a script tag to the document, it's no longer a content script - it's a DOMScript, which executes in the main world (by design).

But yes, it may be worth adding a note about this to the documentation.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot