Ah, thought it was allowed with 'unsafe-eval' in extension CSP. Never had a need for it. Remote code refers to injecting <script> tags into the page then?
When running as a WebExtension you have a higher set of permissions than a regular script (you can to some degree control the browser, after all), so certain parts of JavaScript is off-limits.
