> What keeps a malicious program from replicating the exact changes that Firefox makes when installing an extension? What about just replacing the whole profile folder with one that has a malicious extension installed?

I obviously haven't spent time trying to break this, but I would assume the config file is hashed. You probably could replace the whole profile, but that would be very noticeable to the user.