The issue isn't about having a sufficiently scary warning. It is that the browser has to store the fact that the user has agreed to this warning somewhere (ie, presumably in the user's profile). That means any other software running on the computer with regular user permissions can make the same modification to the profile and then install an unsigned extension without the user's consent.

Typically, when Mozilla finds out about software installing extensions without user consent, the extension is added to the blocklist, but if the extension is unsigned it can just claim that it is ublock origin or adblock plus or some popular extension, leaving no practical way to block it.

This is described in greater detail at https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte...

(in full disclosure, I am a Mozilla employee)

Ah thanks, that's useful context. I was responding primarily to the claim that convolutedness is necessary to protect unsophisticated users, which I interpreted as meaning that the complexity of the UI scares users off. But this is a separate technical limitation that makes a lot of sense.

It's also easy to ignore a warning you don't understand. I know from helping family they don't particularly care what warnings say - they have work to do, and they do know clicking OK makes it go away.

People ignore warnings - they have since the dawn of personal computers. You remember Vista UAC?

Why optimize for the 1% instead of the 99%?

UAC was simultaneously seemingly ubiquitous and not a particularly "scary" warning. It just sounded like bland computer jargon to the uninformed. I was envisioning something like the https warnings that Chrome gives: a clear warning sign that uses emotionally loaded terms like "go back to safety" and hides the proceed link under the fold.

That being said, it's entirely possible that I'm overestimating the intelligence of the average user and that many of them wouldn't blink even in the face of a warning made up to look scary.