They might be today but who's to say it won't start firing off fetch calls later perhaps under a new owner if it gets sold.
Unfortunately the browser extension permissions are not granular enough to warn you when fetch is being used in an extension.
As an example, my password manager extension can read and inject content into any page along with communicating with its server to sync my vault. These are the only permissions Firefox shows me:
* Access your data for all websites
* Get data from the clipboard
* Input data to the clipboard
* Display notifications to you
* Access browser tabs
* Access browser activity during navigation
No indication there that it can also communicate with its server.
I used it for a bit until I realized... I probably didn't want a third party reading all my traffic. But I did like having it for a bit.
(It is linked from the page, but given how the whole page is CTAs... it's hard to notice!)