It just needs to be a preference!
A browser is my everything app. It is the most security essential tool I use daily, which requires vigilance in how I extend it. More users is a crappy proxy for how likely a developer can sneak through an insidious change.
Greasyfork restricts what 3rd party libraries can be pulled in + you have the option of disabling automatic updates in your userscript manager.
Not exactly fly-by-night...