no not at all extensible isn't the same as lenient

having a Content-Type header where you can put in new media types (e.g. for images) once browsers support it is extensibility

sniffing the media type instead of strictly relying on the Content-Type header is leniency and had been the source of a lot of security vulnerabilities over the years

or having new top level JS object exposing new APIs is extensibility but allowing overriding the prototypes of fundamental JS objects (i.e. Array.prototype) turned out to be a terrible idea associated with multiple security issues (like idk. ~10 years ago, hence why it now is read only)

same for SAML, its use of XML made it extensible, but they way it leniently encoded XML for signing happened to be a security nightmare

or OAuth2 which is very extensible, but it being too lenient in what you can combine how was the source of many early security incidents and is still source of incompatibilities today (but OAuth2 is anyway a mess)