

Extensions can block whatever they want, regardless of the user intent, or lack thereof. Developers generally cannot extend the user-initiated action until later, you have to window.open() right away, or else it's blocked. If it doesn't find such a caller on the call stack of the popup-launching code, the popup is blocked. How does the browser determine what caused the action? JavaScript has a way to trace the caller of event-handling function(s) and sub-functions all the way back to a physical user action, like a click.

If the popup happens on it's own, it's blocked. The rules for FireFox, Chrome, and Safari are identical: if the popup happens as a result of a user action, like a click or keyboard press, it's allowed. If a site launches a popup, it's because you did something. To developers, "Popups" and "popunders" are unintended and unexpected sub-window openings to be exact. Many corporate portals use popups, as do web-based email, messaging, media players, and more. Legitimate user-desired actions are not to be blocked. This is all by design and consideration actually. As a long-term webdev, I've seen this evolve from IE6.
