Note that the problem is not limited to "developer mode" because this mode is not required for side-loading of extensions: the user can be instructed to simply drag'n'drop the extension directory onto chrome://extensions page. I've been using this feature a lot over the last 5+ years while developing and testing extensions. Also, a malware program can add --load-extension=/path/to/unpacked/extension command line switch to the Chrome shortcut/registry at least in Windows. 

P.S. There's nothing particularly "harmful" or "dangerous" in developer mode per se as it simply facilitates access to background pages and exposes a few functions either harmless or available elsewhere. As far as considerations go, even devtools console is considered "harmful" because non-savvy users may be manipulated into running js code that steals their personal data.

Interesting, I never thought I could drag the folder w/o Dev mode and loading unpacked ext. Do you plan to fix or warn about symlinks which seem like the only way extensions can impact the host system?

Marking this as Untriaged and as Feature request, for consideration of warning about symlinks. Requesting the respective team for more inputs on this.