I’m yet to monetise an extension (I will soon) so still figuring that out.

In terms of reverse engineer/clones you can get them DMCA’d if they straight up copy your code.

If your extension is complex you can use cloud functions/server-less functions to handle some parts of your extension