Fear not! Altair has always requested permissions for all sites but they were removed, and then re-added at v2.4.3. This is required to allow Altair send requests to your domain without getting CORS errors which is the default behavior. After the permissions were removed, there were several reported issues of Altair not working (e.g. https://github.com/imolorhe/altair/issues/1136). Of course these issues were resolved after re-adding the permissions in v2.4.3.

You can see the relevant commit trails:
Removed permission (v2.4.0): https://github.com/imolorhe/altair/commit/a0cd9fad9bdaba65966c12c8aa5fad409efdfd3c
Re-added permission (v2.4.3): https://github.com/imolorhe/altair/commit/2802c9429ebcd571ca046820dd74f2f893670fb2

You can read more on why these permissions are required here: https://developer.chrome.com/extensions/xhr

Of course if you still feel that the permissions are extremely fishy, you're welcome to use the desktop apps instead, or perhaps host Altair on your domain using one of the available integrations: https://altair.sirmuel.design/docs/integrations

Sorry for the confusion!