N1b I always wondered about this, I use keepassxc and keepass2android. On mobiles it's generally all fine. On desktops for autotype using hotkey, keepassxc needs to know the window title. So reading up a few posts online, I wrote my own simple extension (few lines of code) - just reads the url of current tab and puts the endpoint (https://foo.bar.com) as the window title. That helps keepassxc give me the correct/filtered selection to autotype from thus preventing some phishing attacks.
Unlike browser extensions for password managers which modify the DOM so that you can press the password fill symbols and hence totally detectable+fingreprintable by the js running on the page, such "offline" extensions should be totally undetectable by the webpage's webapp - unless webapps can simply query the browser about all extensions it has and find out - which I don't think they can? Maybe they can query for the window title and find out but not sure if they can?
However I've always shied away from installing this to Tor browser thinking there might be some disadv to doing so, but I can't think of any nor can I find much online. It would help me log into accounts created anonymously over Tor since I don't log into them over clear-net.
Would doing this be discouraged and if so why? I'm more interested in the "why" part as applicable to only this scenario I mentioned (ie. an extension self written and does not interfere in anyway with the webapp or its DOM).