New permissions verbatim: "The developer says this extension collects: personally identifying information, financial and payment information." Wtf. I don't care if that's different wording of existing permissions, I don't want you to have those permissions, NordVPN.

If you look at the Proton VPN extension it only requires permissions for Access your data for account.proton.me and account.protonvpn.com. Whereas for Nord it's required to access all website data, not optional. If Nord needs to access data for account information, they should restrict it to Nord domain(s), rather than leaving it open for this extension to be able to read all website data. That seems like an implementation improvement they can make, rather than excuses.