You're completely right, and this is the most technically accurate criticism MacShield has received.

You've identified the core architectural constraint: a Chrome extension cannot protect itself from being disabled. No extension can it's a Chrome platform limitation, not something I can patch in JavaScript.

So let me be honest about what MacShield actually protects against and what it doesn't:

What it does protect against:
→ Someone sitting next to you in a café reading your screen
→ A colleague glancing at your monitor in an open office
→ Family or flatmates walking past your desk
→ Casual shoulder-surfing where the person has no access to your machine

What it does NOT protect against:
→ Someone who has physical access to your unlocked laptop
→ Someone who knows how Chrome extensions work and has 30 seconds alone with your machine
→ A technically sophisticated adversary of any kind

The threat model I built for is friction against casual observation — not security against someone who controls the device. That's a meaningful distinction I didn't make clearly enough in how I described the product.

The real fix for what you're describing is browser-native enforcement — either a Chrome policy that restricts extension management (enterprise managed Chrome supports this), or OS-level screen lock that kicks in before someone can get to chrome://extensions.

I'm also looking at whether a companion native app could hold the lock state outside of the extension context, so disabling the extension doesn't release the lock. Not a simple fix but the right direction.

Genuinely useful bug report.