Let me guess, they vibe coded their vibe coding extension?

No.

Well probably yes but not at all relevant here... the problem wasn't the legitimate extension, it was cursor serving a fake malware one.