The extension now requires download permissions in order to be able to export user's config file. It is not used for anything else besides that single action and there is no malicious intent behind it (and never will be). YouTube Redux is open source and all code changes can be verified in its GitHub repository.

Edit in response to your edit: Your concerns are absolutely justifiable. While at this moment it's a "trust me bro" situation, extension takeovers do happen and this is indeed a security risk for users. That said without delay I will be making this permission optional as well as allowing the user to save the config manually if that permission is denied. Thanks for the feedback and sorry for the scare!