Thanks for taking the time to share your concerns.

RYD hasn’t changed how it handles your data. What changed is how Mozilla labels these permissions - not what the extension does with your data.

Ajay, the author of SponsorBlock and DeArrow, discusses the same problem here:
https://discourse.mozilla.org/t/the-new-data-transmission-permissions-seem-to-be-misleading-to-users/149410

The extension is actually recommended by Mozilla, so they do not consider it harmful or dangerous.

RYD uses only the data it needs to display dislikes and count votes.

Its site permissions cover YouTube and its own API at returnyoutubedislikeapi.com. RYD doesn’t read other websites, and these site permissions cannot be used to access them.

Personally identifiable information - RYD’s randomly generated, anonymous user ID, used to count votes. This isn’t your Google or YouTube account.

Browsing activity - moving to the next YouTube video, so the extension can send its video ID and fetch the new dislike count.

Website content - things like the visible like count, which helps work out dislike estimates.

Website activity - clicking Like or Dislike.

Again, this concerns activity on YouTube. The extension isn’t watching everything you do across the internet - these site permissions simply don’t allow that.

Those new labels can sound scary, but they don’t allow the extension to access more websites.

RYD’s source code is public, so you can check how it works: https://github.com/Anarios/return-youtube-dislike