Secure for whom?

Browser users. Pre Mv3 extensions were a huge vector for malware. My in-laws were hit by that.

You can write malicious MV3 extensions. The changes' stated reason was performance, not security.