It needs to read and modify the page to highlight words on it. So to highlight words on all websites it needs access to all websites. I'm pretty sure any add-on that modifies visited pages needs permissions like this, unless it's limited to a specific domain, e.g. facebook.com.

“Access your data for all websites” indeed does sound scary (see explanation why it's phrased this way: https://blog.mozilla.org/addons/2018/02/01/understanding-extension-permission-requests/), but luckily this add-on is open-source, so it's fairly easy to verify that it doesn't try to steal your data or anything like that: https://github.com/ainzzorl/wordhighlighter The source code can also be viewed using extensions like https://addons.mozilla.org/en-US/firefox/addon/crxviewer/