That would allow any third party software running on your computer to add malicious plugins to the browser (which has happened in the past and is in part why it requires Moz' signature now).

Most users, ie, the average user plus a significant amount, don't really care that they can't install random addons from outside the addon store.

Put the certs in the program directory. If malware makes it to that point then you will have lost the battle in any reasonable threat model.

What would prevent malicious software running on the computer from installing a malicious version of Mozilla? What's their attack model?

The attack model is largely that fairly normal software wants to install adware on the computer. The software isn't direct malware but will attempt to install and activate addons, redirect the users homepage and search engine as well as setting various other options on the user behalf that are ultimatively harmful to the user experience in Firefox.

Mozilla wants their branded Firefox to be something the user can trust and that means controlling what code with elevated privileges (ie, Addons) can run in the browser.

edit: It should be mentioned that in response to the first question; Firefox performs some binary verification and won't run or attempt to repair if it detects tampering.

This threat model appears to optimized for the argument giving control to mozilla. It assumes that your system is essentially compromised but the attacker has just exactly so many self-imposed restraints that they can be thwarted just as long as things are under mozilla's control. But if you give the user control then suddenly the balance tips and their already-compromised system will be used for bad things.

It's a really long-winded way of saying "we know better, you cannot be trusted, freedom is slavery".

The correct solution is to remove malware, not to play games with it that require freedom-reducing gambits.

There is plenty of software that adheres to these constraints. Most adware doesn't want to actively damage the system and doesn't worm too far in. In the past, adware would simply drop it's toolbar payload into the Mozilla and Chrome addon directories, which would after confirming it with the user, activate. Same thing with homepage and search engine settings (which still get modified).

I think it's a bit unfair to quote Orwell when the overall goal is to prevent the user from hurting themselves, not brainwashing them into thinking they don't need unsigned addons. If they need those there is the developer edition, which is officially supported by mozilla and allows installing any addon you like.

The default installs that most users will see simply have a different default setting. If you don't like that you can choose another edition or compile Firefox yourself.