How is this a particular attack surface? Changing an about:config value requires quite a bit of effort from an attacker and enabling this extension would not actually pose a security risk either. There's plenty of better about:config values to be changing, too.
Even if the add-on is "enabled," it's doesn't initialize itself unless a specific about:config value is also manually flipped
Attack surface 101 / reason nobody else does this