Websites able to add extensions to Safari without user permission? Potential high security risk!

Are websites able to add extensions to Safari without user permission? If so, this seems like a big security vulnerability. After clicking on some links in Twitter/X I noticed that I was getting popups about expired Mcafee security (I don't run that software). I removed a bunch of extensions and the problem went away.