A viewer add-on with tens of thousands of installs sent live Twitch session tokens to a commercial bot operator.