Even if this was an opt-in feature the implementation is still terrible and a massive security hole. If id wanted the desktop app entirely and solely for this purpose i still would not expect my browser extension to have full access to my computer. I understand the app does, not the browser extension.
No matter how you twist and turn this situation Anthtopic has still introduced a major security issue in their application. It might be a bit far to call it malware immediately but it sure does open up a massive attack vector to take advantage of.
The fact that the end user is not even informed or have a choice about this makes it all the more problematic and Anthropic not commenting on it makes me think its either intentional or at the very least already known.