Does simulation extractability require that the protocol have a backdoor in it?
Extractability inherently requires that the party who holds the extraction trapdoor can extract the witness. Therefore, it is important that the common reference string (CRS) is set up by a trusted party in the real protocol. However, this requirement for setting up the CRS in a trusted way is not only specific to extractability but also required by other notions such as soundness or zero-knowledge (see, e.g., [1] where the fact that the CRS is not set up by a trusted party is used to attack a protocol). Ultimately, you may observe that this trusted setup requirement is not only specific to zero-knowledge protocols, but applies to every protocol which relies on a CRS.

Regarding the UC-secure NIZK part of the question: Roughly speaking, realising a UC compatible zero-knowledge protocol requires to achieve simulation extractability. Therefore, one also has to take care that the CRS is set up by a trusted party in real instances of the protocol.

References

[1] http://stevengoldfeder.com/papers/ZKCSP.pdf