Most don’t design extensions that require frequent changing of the whitelist. It’s common that extensions are either built for a specific set of channels that infrequently changes, or is always public.
Those who do want a more frequently changing access rights often have a public extension, that’s still functional to all users, but only offers enhanced/additional features for certain users. This way even if some random channel installs it to check it out, they can at least experience the core functionality, and if the extra stuff is premium features then it increases the likelihood that they’ll request access to them where as if they can’t test the extension at all they’ll likely never touch it.