They have control over what they distribute. Chromium and Firefox are both open source and people can (and should) use derivatives they find acceptable.

Sure, just change the source and build from source.

The reason is that V2 opened the door to some fairly nasty attacks. "This extension can read everything you enter on any form". There were some extensions that did exactly what you're thinking of.

I suspect that nobody will make a browser that lets a plugin do that any more. It's easy, but on closer reflection, would you do it?

People can create the world, but they do need a lot of time. A lot of money buys you time, so nobody 'poor' can keep up. That wouldn't be a problem for web UAs, if the standards wouldn't be 'improved' at the same path as well. It's kinda like proof of work, but for standard bodies and ownership of a system.