Which part of “this extension has access to all your data on all sites” is a surprise?

While I see their concern I would be more worried that the sensitive data is exposed to workflows that deserve the “enterprise” warning label.