I think browser makers don't offer this because any protection put in place would be easy to work around.

For example, even if the extension itself can't make requests, there are plenty of ways to 'trick' a webpage into making a request on your behalf when you have permissions to modify the Dom of the web page.