Safari runs disabled extensions

from blog The Desolation of Blog, | ↗ original
Little Snitch is great at catching apps "phoning home". Much to my surprise, a couple of months ago Little Snitch caught a disabled Safari extension phoning home (where "home" was Amazon Web Services). In fact this extension had never been enabled in Safari. After further investigation I learned that on every launch, Safari runs every registered extension — that is, every extension that appears in Safari's Extensions Preferences — whether the extension is enabled or disabled.