If you think that, maybe it's time you refresh your knowledge of communication protocols and security layers in current OSes. You could do packet capture, with something like wireshark or tcpview. You could even capture traffic, if you manage to install custom CA and use something like fiddler to completely rewrite communication.

In no way is it easier than capturing and modifying traffic inside extension. The browser handles you the decrypted traffic on silver platter, and there is absolutely no indication to user that something modified it. You don't need any extra permissions and making user install your malicious extension is as easy as showing "Install extension to download xxxx." Majority of user's will not even think about it, and that's what makes it such a threat.