Pocket, the service for collecting and syncing articles, is basically a separate thing from pocket suggestions.

The original service was integrated a while ago, but it doesn't really have severe privacy implications. If you click a pocket button, it asks you to log in. If you don't click, it does nothing. This is the one that's hard to disable, but it's an annoyance more than a security problem.

Pocket suggestions are newer, showing articles on the new tab page. They are trivial to turn off, and for what it's worth all the sorting/filtering is done locally.

It's the automatic opt-in that concerned me more than anything; any time a company chooses to force a new feature on their users I question the necessity of the action as well as the intent. I had the same issue with automatic opt-in of their telemetry and Studies; I never asked for that and I don't expect it from a company that touts their stance on privacy as a reason to use their software.

My point being, even if Pocket is 100% benign and never leaks any user data, the user should still have a say in whether it is turned on by default on a fresh installation. Anything less is user-hostile, a descriptor Mozilla should avoid if possible.