The HelixToken doesn’t represent a user.
As such it cannot be used with EventSub WebSockets.
HelixToken is only valid for calling the “regular” API (excluding anything scoped)
To put it another way: no an extension frontend cannot utilise EventSub as there is no sensible way to get a user token to use in order to access EventSub.
Additionally with the upcoming changes to follows, you will need a broadcasters token, and you can’t leak that in an extension front end.