Most extensions which include malicious code seem to be legit, otherwise nobody would download them. They have to perform some actual function which people want, and perform it properly, for the extension to be widely downloaded and not immediately uninstalled because it doesn't work. Seeming legit does not mean there isn't clipboard or other malware buried somewhere in the extension. Unless the extension is open source and you can review the code, then installing it is a risk, regardless of how legit it seems.

There are very few extensions which you actually need to install, and all of them should be open source and have GitHubs you can review. Extensions like uBlock Origin, Privacy Badger, HTTPS Everywhere, NoScript. The vast majority of extensions which people install are completely unnecessary and serve only to pose a security risk.