and the last one is to reduce attack vectors

Ah yes, the good old walled garden approach.

Not very "open", is it?

i mean I don't like it either, but I do believe them in this instance that it's mostly in service of not letting installers just sneak in a toolbar

I think that this is misguided. If a malicious installer sneaks in toolbars it can also install a keylogger/send all of your data to a server/install a firefox fork with the toolbar preinstalled/etc.

If anything this kind of thing only hurts the users that know what they are doing (such as someone wanting to install a 3rd party addon or someone wanting to install addons via nix).

> If a malicious installer sneaks in toolbars it can also install a keylogger/send all of your data to a server/install a firefox fork with the toolbar preinstalled/etc.

If it's totally rogue malware, sure.

The toolbars, on the other hand, were coming from companies like Oracle that operated entirely within the bounds of the law.

Installing a firefox fork is also within the bounds of the law.