Reviving this thread because I am still seeing this issue with Web Extensions. It would appear that until you "Always allow on every website" the extension simply doesn't run (even in the background) in order to receive the onInstalled event. Furthermore, even after setting the proper web site permissions and toggling the extension off and then on, it does not 100% of the time fire the onInstalled event. In my case, we want to show a tab with a welcome page for quickly onboarding after installing the extension. Specifically, we want to describe Safari's opt-in site permissions and how to make our extension work with those settings, but we are in a catch 22 because we can't even show that page until the user opts in to site permissions.

I would like to understand the reasoning here as well. It seems like a Safari App Extension gets default access to whatever pages the user visits, whereas a Safari Web Extension has to ask for specific web page permissions. I can understand the latter from a privacy/security perspective, but it doesn't make much sense for the former because an App Extension has free rein. Why is an App Extension treated differently from a Web Extension in this case? For example, 1password's App Extension has access to all sites without an explicit opt-in: ...but Okta's Web Extension does not: Both have very similar functionality, that of suggesting form-fills for logins on any web site, but because Okta is a Web Extension, it gets treated differently. Why is that? It seems like both App Extensions and Web Extensions should require the same opt-ins or not. Otherwise, it's on the developer to opt for a native App Extension over a Web Extension for the better UX.