IIRC, extensions are considered trusted because the user has given up-front permission for whatever the extension wants to do.

In the case of sockets, the manifest needs the "experimental" permission. And I would assume (but have no idea if this is true) that once it's not experimental, there'll be a separate permissions flag for web sockets.