Yes, but it's about the tiniest step they could possibly take. It just officially makes violating "trust me, bro" against the rules, but does absolutely nothing to prevent it, nor allow the user to directly prevent such abuse. Some extensions don't need Internet access at all, but there's no (easy) way to stop it from happening. Others only need occasional access for updates, but there's no user control for whether that's all they're doing.