Web extensions are not limited because of any inherent limitations in technology but because of policy.

If Firefox wanted they could have created a new extension system with XUL that would also have the same limitations the web extensions do. For fairly obvious reasons they decided to transition to Web tech based extensions and used that opportunity to tighten up security as well.

Whenever you have a chance to do something in a declarative way, it's the better way to go IMO. Sad to see XUL removed... newer Firefox extensions are integrated much more poorly and are slower when the browser is busy (due to JS). Probably not noticeable for one tab though.

> security considerations, that is, to protect against malicious code.

Only in the "cannot fuck up your computer" kind of way. All addons I've installed still require "Access your data for all websites", thus have full access to my online life. Thus I only install addons from sources/authors i trust, just like back when jQuery was the coolest thing.