how is it technically theirs? you store it client side. it doesn't go to their servers. and if you don't trust them, then download the source, compile it yourself, and run the extension yourself. https://github.com/getAlby/lightning-browser-extension
Sure if you compile your own extension sure it takes the "them" out of the equation. Otherwise it's still custodial nostr. Iirc they do provide backup via email auth? Opting in to that is fine but now the scope is your whole browser. And then your still left needing a whole different method on your phone. Feeding a nip07 scriptlet with nsecBunker signatures could be a trivial to self host answer.. putting it on the hit list.