This is currently working as designed, so I'm going to move it out of the security queue. We do see sync being used as an attack vector, so I would like to see changes made here, but that's a product decision that would need to be made.

Yep, once you approve an extension's permissions, we consider them approved on all devices where you sync. If we didn't do it like that, then every time you sign in on a new device, you'd get a warning for every extension you installed, even though you previously approved it.

I'd argue that people should have a warning for every extension installed when they sign in to a new device, or at least be given the option to get a warning.

Shared PCs are very common, particularly in the home environment, and people tend not to sign out of Chrome.

As other folks have pointed out, this is currently WAI.  If you want to opt out of having extensions automatically sync'd across devices, you can disable sync (optionally just for extensions, if you want to keep syncing history, etc).

We have been investigating whether we can make this better by incorporating more sophisticated checks (e.g., warnings for when you sync from a suspicious device that we don't know is you, etc), but to add warnings eacb time a new extension is added greatly reduces the utility of extensions sync.

Marking this as available, since we would like to do something here in the future, but it's not on our immediate roadmap.