> dynamically loaded code not bundled with the extension

How could that be enforced on open source browsers like chromium which can always sideload extensions and/or be modified/forked to not have such limitations?