Is there a way to tell if an Azure Devops Extension is secure to use?
Can't comment yet, but most extensions host their source code publicly. So you could read the source code to check if something is going on that you don't want. 

If the source code is not available, you could check the company for certain certifications like ISO 27001 or the like so you know they get audited.