But why can a theme make web requests?!
Because we live in a broken world and nothing matters.
On a more serious note, it's a pretty horrifying misfeature. What's even more worrying is that by all appearances Microsoft doesn't give a shit, if they apparently didn't even bother removing the malicious extensions that were reported. Not that I'm surprised, but still.
I, uh… I don't get it. Somebody help an idiot out? I haven't had my morning cuppa yet so it might just be a lack of caffeine.