That's true. It is open source. You could just modify the code to not do the validation check. And then install the extension that way.

It could get forked and maintained by another group that maintains a separate database.

I'm on the fence about this monetization model, running a database hit by thousands or millions of browsers is going to cost money. We'll see if the project remains a success

the permissions control is done by firefox, and as you can see in the add-ons settings it only asks for access to this list of websites

Access to your data from sites in the domain googlevideo.com
Access your data from sites in the domain youtube.com
Access your data from sponsor.ajay.app
Access your data for dearrow-thumb.ajay.app
Access your data from www.youtube-nocookie.com

and optionally the user can give you access to all sites but it is not necessary. This can be changed but in that case firefox will warn you that the plugin requires new permissions.