Browsers occasionally push users to enable the extension on every domain and that will cause issues:

• Document reason for "Access your data for all websites" browser permission (more prominently?) #7314
• "Access your data on all sites" permission corrupts Google search result subtitles. #7319
• RGH is injecting code into websites other than Github. #7336

What can Refined GitHub do when this setup is detected?

Probably:

• immediately self-revoke the permission
• tell the user what to do next, either via alert() or by opening a new tab on the wiki
• call permissions.request() on github.com, if the browser is Safari, because it starts without that permission and because at this point it probably won't prompt the user