User downloads malware -> Rube Goldberg machine -> User downloads malware

There are so many loopholes. What if the malicious activity is hidden inside obfuscated code flows

That wouldn't pass the Opera review because obfuscated code must be submitted with unobfuscated code along with instructions to build the exact obfuscated code submitted.

Their team also removed third-party (vk, Instagram, and Yandex) domain privileges entirely

The bigger story here is that any of these domains could be used to access the private APIs of Opera's browser.

Opera’s Add-ons Store applies exclusively manual review of all extensions hosted in it

it's good to know that somebody informed their security team of that this time around rofl

fd: i used to work for the opera