The extensions list appears regardless of being admin or not. if you give this right, a malicious user can change extension type to vbs and upload viruses.