Manifest V3 narrowed some Chrome extension APIs but left the broadest ones intact, and the gap between what an extension requests and what it strictly requires is where most avoidable exposure sits.
A few common substitutions. A toolbar tool that acts on the page the user clicked needs activeTab, not tabs; the first is gesture-gated and auto-revoking, the second reads every open tab's URL continuously. A tab-organiser usually needs tabGroups rather than full tabs access. Anything storing state can often use storage.session, which scores at the very bottom of the risk range, instead of persistent storage.
The pattern holds generally: the low-risk API is usually the narrower, event-scoped version of the broad one, and it exists precisely because the broad one was over-used.
When reviewing an extension, the question worth asking is not whether a permission is dangerous in the abstract, but whether a narrower API would have done the same job. If one would have, that is the finding.
A permission risk reference is at zovo.one.