users script or not user script

I think the user script guy is right. Let the user customize how she wants. The only thing is that you should make her task easy and provide all the documentation, if needed.

too bad some user script addon was found to be malicious

have fun trusting a million 3rd party browser add-ons and scripts that can and will get compromised or sold to bad people

this is an old article but this kind of thing still happens to this day:
https://www.pcworld.com/article/2089580/spammers-buy-chrome-extensions-and-turn-them-into-adware.html

basically: a ``free'' extension gets popular, then a criminal offers to buy the extension from the developer, then the criminal puts malware in an update, giving the users ransomware, some MITM shit, etc.
then the original developer pretends that it was ``accidentally compromised'' even though it was intentional