The one issue there is with developers that sell out their extensions to shady people. While I love the XUL era way more than this current trash, the security model with XUL would have done nothing to limit the blast radius and the update system would potentially install it silently
That said there used to be a human review system in place for extensions. I'm not sure if they do that any more
Re:Mozilla’s Uncertain Future
by badsectoracula on Monday August 17, 2020 @07:05AM
(#24186046)
That is an issue with the current system too, sure an extension isn't able to look at arbitrary files in your system, but it still is able to look at your bank site, passwords, etc and can still do a ton of damage.
Web extensions aren't safe by default, you shouldn't trust them any more than any arbitrary EXE file.
What security model? Pretty much every WebExtension i've come across asks for practically everything and even Firefox's own addon page tells you to only install extensions you trust. At that point if you trust the extension source why bother with the security model in the first place? You already trust the extension developer to not break anything.