It seems like the scenario that this defends against would involve a compromise of the at least the OS user's account, at which point there are far more interesting things for an attacker than impersonating a host application.

Please see http://www.chromium.org/Home/chromium-security/security-faq#TOC-Why-aren-t-physically-local-attacks-in-Chrome-s-threat-model- 

Pardon me but I guess I described the issue incorrect :-(

The issue is that there is no secure binding between the extension and the native application which makes it impossible creating a vetting infrastructure.