the permissions control is done by firefox, and as you can see in the add-ons settings it only asks for access to this list of websites

Access to your data from sites in the domain googlevideo.com
Access your data from sites in the domain youtube.com
Access your data from sponsor.ajay.app
Access your data for dearrow-thumb.ajay.app
Access your data from www.youtube-nocookie.com

and optionally the user can give you access to all sites but it is not necessary. This can be changed but in that case firefox will warn you that the plugin requires new permissions.