But wouldn’t it be possible - if a bug was to be found in one of these popular extensions – that this actually increases the risk? As many people use it, I would assume that there would be quite a large interest in finding such bugs.
Would an extension possibly cause security problems even if the target browser does not have a specifically exploitable bug? I believe that Chrome tries to keep security issues at bay through its sandbox, but is this still a possible scenario?
Yes, the more components you have on any process, the more room for vulnerabilities.
In the case of browser extensions, some of them have permission to read all your history, cookies, navigation data and even change code on the pages you access. Some of them don't have vulnerabilities, but are design to inject malicious code.
AdBlock and NoScript are popular extensions, so it's expected to them to be targeted.
Adding new software always increases risk. It must be balanced against any benefits you might receive from the use of it, how sensitive the data it might be able to access, and how "risky" you think the software is. When I speak of software riskiness, I mean how good the programming practices are of the group that wrote it. Often in larger organizations they review source code or at least the processes businesses perform to ensure their code is reasonably secure.
Absolutely an attacker is going to target things that are in wide use. It's sort of the same reason that for a long time there was little Mac malware or vulnerabilities discovered...no one cared.