It could be worse. Software push is how browser distribute extensions. And they are ridden with spyware [0]. Pull by maintainers, deferred rollout, veto and rollback might what saves us yet.

[1] https://blocked.cdn.mozilla.net/