Have you ever tried preventing an extension from being updated (you can't) or rolling back an update?

Go ahead and try.

I agree that 98% of the time it is fine, but that is not the point. I want to have control over the software that runs on my computer, especially if sometimes useful functionality is stripped away, or malicious code can be run.

Off the top of my head, I had Google Drive install a chrome extension which then informed me that it needed me to grant it more permissions than it had when it was installed without asking by Google Drive, and then when I didn't grant them, it removed itself after a few days, without a trace.

Or there was the time that the Chromecast extension disappeared. Of course, this was because Google integrated that functionality directly into the browser, but, it made me feel very uncomfortable that the software on my computer was so unpredictable.

And there are many other times that extensions have just "upgraded" themselves into breaking.

Out of frustration after feeling no sense of agency, I started using git to track the changes to my chrome config folder. Even if I used git to roll back the filesystem to its previous state, I then have to modify the extensions to not have the right url to check for updates, and then there are still other mechanisms to thwart that. At best, I was able to manually re-enable the extensions I want, and I had to write a script to automate it after each time I started chrome.

Outside of the Chrome extensions themselves, when you install several Google products, like Drive or Google Earth, it adds it's spyware-like "keystone agent" updating daemon to three different locations. WHY? If you remove any of it's hooks, it just re-creates them. And it will monitor your filesystem and irreversibly apply updates to Chrome, which may remove features (like the ability to side-load extensions, or save HTML5 video, or mandatory WideVine DRM).

None of this is made clear to you. It will ask you for root access just so it can install its system-wide updater in two locations, but if you deny it, it will still install it for the current user. If you start to remove it, it will never alert you that it is being tampered with or explain what is going on, it will just resist like spyware, re-creating itself.

Out of frustration, I just started making files immutable so that it couldn't re-inject itself. Obviously that is not ideal, but I had work to do and I was sick of it worming around my computer.

It doesn't have to be this way. I understand the importance of updates. But Google doesn't have to do it in such an underhanded and frankly hostile manor. But this reflects a culture of gaslighting of the user, and general hostility.

So, it makes sense that malicious actors could piggyback on Google's already user-hostile platform. Google is already doing much of the work for them.

EDIT:
And before anyone responds by saying that there are technical means to take control of the Chrome browser that I missed, I am sure there are, but that is not the point. I am aware that there is an environment variable you can set that will request that Keystone Agent stop updating, but it is completely undiscoverable, and does not actually stop Keystone Agent from running. Someone should not have to have an extensive understanding of software development just to be able to say "NO", and accept the responsibility for it.