daycare-escapee The release notes called it an "extension" because there's already a feature to push apps from owner to secondary user profiles and they extended it so that any apps installed in any profiles could be pushed from the owner profile to any profile.
The way I see it is if different people use the device in secondary user profiles they can (either on purpose or by accident) install a malicious app. If you can push apps from secondary users to other secondary users or even the owner profile, you could be inadvertently installing malicious apps. Instead the true device owner would install the apps themselves, hopefully from a safer source, and if there's a conflict they can remove the apps from all users and install the correct one.
An example could be a kid installs a modded or malicious version of some mobile game. A parent sees them playing and wants to play too. With the old extension, they could install the malicious version, putting their privacy at risk.