Those are all necessary permissions since the plugin is basically building a completely new keyboard-driven chrome. It is not simply a skin that remaps a bunch of key bindings.
For example, to open a bookmark from the command line requires read access to your bookmarks in order for the plugin to present you with the list of bookmarks and eventually allow you to search or navigate it somehow. The same applies to opening something from your browsing history or resurrecting a closed tab. Tab switching requires access to the tabs. Clipboard access is for things like copying URLs or the selection in visual mode to the clipboard.
Vimium itself is open source on GitHub and you can see for yourself what it's doing with your data. The Firefox port is by one of the most active project contributors.
Most of the ad-supported media is trashy anyway, churning at the highest rate possible low quality content with click-bait titles. Because SEO and clicks. Even the well-respected media outlets have started jumping on the click-bait wagon.
The alternative is something like Medium - you pay a monthly fee and the money gets distributed between the authors based on your likes. Medium has a growing partnership with big media outlets that republish articles there. I tend to read there most of the time. Not only is the reading experience better and uniform but I directly vote with my wallet.
Is it that hard to have a privacy-respecting service whose only purpose is to collect a monthly fee and to allow me to distribute it to participating media sites via some kind of "Support" or "Like" button? The problem is that most Internet users do not value their privacy and hence do not care that a shady 3rd party is tracking them and filling their screen with obnoxious ads, just as long as they keep getting "content" for free. It will take a tremendous amount of effort for the privacy revolution to happen.