Since then, is it now possible to configure a user to only be able to execute a limited white-listing of queries? Is this something that could now be implemented through extensions?
Since pg_stat_statements infrastructure, it is possible to create extensions that prohibit query execution for certain users (see sql_firewall [1] as an example).