Thanks for sharing your concerns.

RYD hasn’t changed how it handles your data. What changed is how Mozilla labels these permissions - not what the extension does with your data.

Ajay, the author of SponsorBlock and DeArrow, discusses the same problem here:
https://discourse.mozilla.org/t/the-new-data-transmission-permissions-seem-to-be-misleading-to-users/149410

The extension is actually recommended by Mozilla, so they do not consider it harmful or dangerous.

The extension uses only the data it needs to display dislikes and count votes.

Its site permissions cover YouTube and its own API at returnyoutubedislikeapi.com. RYD doesn’t read other websites, and these site permissions cannot be used to access them.

Personally identifiable information - RYD’s randomly generated, anonymous user ID, used to count votes. This isn’t your Google or YouTube account.

Browsing activity - opening the next YouTube video, so the extension can send its video ID and fetch the new dislike count.

Website content - things like the visible like count, which helps calculate dislike estimates.

Website activity - clicking Like or Dislike.

Again, this concerns activity on YouTube. The extension isn’t watching everything you do across the internet - these site permissions simply don’t allow that.

Those new labels can sound scary, but they don’t allow the extension to access more websites.

RYD is open source, so you can see how it works: https://github.com/Anarios/return-youtube-dislike