They have a backdoor that allows scams. Just be very careful what sites you allow access. They allow some sites to drain all funds when they don't have access to those funds. The really bad part about metamask is even if they know of a place scamming they will not help or put out a notification to help protect ppl. All they would have to do is put the smallest effort and they could protect 100s of millions. It seems like some of their team is in on it