Hi thanks for the feedback, I really should have communicated this change better.

The change to permissions was unfortunately required to allow embedded videos within iframes which were not working properly prior to this change. The reason full URL access is needed for this particular fix is because prior to this the extension was only listening for requests that originate from youtube, so if a request was made from an iframe embedded within a different site this extension would not see it and so would not redirect embedded youtube videos as expected.

The discussion for this change can be found here on the project repo:
https://github.com/SimonBrazell/privacy-redirect/issues/6#issuecomment-574510452

I hope this helps to clear things up, and apologies for the lack of explanation.